cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Event ID 20845

Jump to solution
I'm currently seeing a couple of events that I don't see in the mcafee_application_and_change_control_8.3.x_-_windows_product_guide. The event is as follows: Event Category: Application Blocked Event ID: 20845 Threat Severity: Error Threat Name: VTP_TRUSTED. I searched the product guide for event ID 20845 and nothing comes up.
1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: Event ID 20845

Jump to solution

So the error is misleading. VTP_Trusted means its allowed. 

Yes its confusing and i have been trying to get this fixed and documented in our guides but its still not updated. 

You can submit a ticket with support to help prioritize that fix and update if you would like but bottom line 

when you see VTP_Trusted this means it allowed and didnt block. its poor event notification on our part. 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

7 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Event ID 20845

Jump to solution

Are you asking about vtp trusted? 

 

In solidcore it works the same as ENS.

 

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-common-client-product-guide-windows/page/GUI...

VTP trusted means that the binary was signed by microsoft or mcafee and we allowed it. 

 

VTP

 

 

VTP fallback is a good  option to avoid EXECUTION DENIED events on non-critical binaries such as Cortana’s DLL, Defender, etc.

 

8.2.1 update 5 and above includes a new mechanism to allow the execution of trusted binaries (MSFT & MFE signed) to avoid execution denies of non-solidified files.

 Additionally this logic will NOT allow non-solidified binaries to be launched in boot time prior VTP service starts

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted

Re: Event ID 20845

Jump to solution

So your stating that the reason Im getting the Application Blocked is due to the application launching at boot time and the VTP service has not started?

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Event ID 20845

Jump to solution

No i dont know the full extent of the error you are seeing and when you are seeing it.

 

I am stating VTP_Trusted event is due to the VTP feature.

 

 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 8

Re: Event ID 20845

Jump to solution

VTP_Trusted is usually allowed not blocked. Even though it says error. Can you show us one of the events fully? 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted

Re: Event ID 20845

Jump to solution

This is the event.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: Event ID 20845

Jump to solution

So the error is misleading. VTP_Trusted means its allowed. 

Yes its confusing and i have been trying to get this fixed and documented in our guides but its still not updated. 

You can submit a ticket with support to help prioritize that fix and update if you would like but bottom line 

when you see VTP_Trusted this means it allowed and didnt block. its poor event notification on our part. 

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

Highlighted

Re: Event ID 20845

Jump to solution

Benjamin Ellis,

           Thanks for your help. This answered my question. I think I will exclude these events from reporting up. 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community