Logon Error, GDIPLUS.DLL

[LT2C]

After Windows Update  KB4457145 (https://support.microsoft.com/ca-es/help/4457145/windows-7-update-kb4457145), users can't logon on endpoints.

When user logon, appears windows Popup (Explorer.exe) with error and logon not continues.

Solidcore Event

User.Init

• Deny Reason: Local Whitelist- File not present in whitelist
• Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
• Event Display Name: Execution Denied
• Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
• Parent Process Name: C:\Windows\System32\userinit.exe
• Performed By: UserXXXX
• Process Name: C:\Windows\explorer.exe

Other error reported

• Deny Reason: Local Whitelist- File not present in whitelist
• Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
• Event Display Name: Execution Denied
• Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
• Parent Process Name: C:\Windows\System32\services.exe
• Performed By: NT AUTHORITY\SERVICIO LOCAL
• Process Name: C:\Windows\System32\taskhost.exe

Software Version:

• ePolicy Orchestrator 5.9.1
• Mcafee Application Control  ( 8.0.0.855, 8.0.1.223 )

PD: Sorry for my English Level.

[BEllis]

What extension version are you running? 

Please make sure you have the latest 8.0.2 extension and client and make sure the windows update rule group is assigned to the machine.

[LT2C]

Hi Benjamin,

We're running Solidcore 8.2.0.126 extension and Solidcore 8.2.0.140 client.

The default Windows Update rule is assigned to the workstations.

[BEllis · Accepted solution]

Please open a case with support then and provide a gatherinfo, with the details still in the logs.

[wouterr]

same issue here on GDIPLUS.DLL and comctl32.dll.

As far as i am aware from our support ticket, engineering is aware of this issue.

For now best you can do is add these files as trusted binary on hash.