cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 7
Report Inappropriate Content
Message 1 of 8

Logon Error, GDIPLUS.DLL

Jump to solution

After Windows Update  KB4457145 (https://support.microsoft.com/ca-es/help/4457145/windows-7-update-kb4457145), users can't logon on endpoints.

When user logon, appears windows Popup (Explorer.exe) with error and logon not continues.

 

Solidcore Event

User.Init

  • Deny Reason: Local Whitelist- File not present in whitelist
  • Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
  • Event Display Name: Execution Denied
  • Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
  • Parent Process Name: C:\Windows\System32\userinit.exe
  • Performed By: UserXXXX
  • Process Name: C:\Windows\explorer.exe

Other error reported

  • Deny Reason: Local Whitelist- File not present in whitelist
  • Description: Application Control blocked this file because it is not whitelisted. To execute this file, add the file to the whitelist.
  • Event Display Name: Execution Denied
  • Event File Name: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24234_none_5c05ea59a00ef565\GdiPlus.dll
  • Parent Process Name: C:\Windows\System32\services.exe
  • Performed By: NT AUTHORITY\SERVICIO LOCAL
  • Process Name: C:\Windows\System32\taskhost.exe

 

Software Version:

  • ePolicy Orchestrator 5.9.1
  • Mcafee Application Control  ( 8.0.0.855, 8.0.1.223 )

 

PD: Sorry for my English Level.

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

Please open a case with support then and provide a gatherinfo, with the details still in the logs.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

7 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

What extension version are you running? 

Please make sure you have the latest 8.0.2 extension and client and make sure the windows update rule group is assigned to the machine.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted
Level 7
Report Inappropriate Content
Message 3 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

Hi Benjamin,

We're running Solidcore 8.2.0.126 extension and Solidcore 8.2.0.140 client.

The default Windows Update rule is assigned to the workstations.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

Please open a case with support then and provide a gatherinfo, with the details still in the logs.

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

same issue here on GDIPLUS.DLL and comctl32.dll.

As far as i am aware from our support ticket, engineering is aware of this issue.

For now best you can do is add these files as trusted binary on hash.

 

Tags (1)
Highlighted

Re: Logon Error, GDIPLUS.DLL

Jump to solution

We have the latest Solidcore version and windows rule in place and still noticing the same error

 

Threat Target File Path: C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24356_none_5c07bd39a00d5ba6\GdiPlus.dll

Event Category: Application Blocked

 

Please suggest

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

Did you resolidify after upgrading to 8.2.1.143? 

If not you need to resolidify

McAfee Support

Benjamin Ellis

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 8 of 8

Re: Logon Error, GDIPLUS.DLL

Jump to solution

Also make sure you manually update update your policy as described in the releasenotes.

Especially the skiplist rule on the "\windows\winsxs\temp" folder should be removed from the Application Control > Windows > McAfee Exclusion Filters and Application Control > Windows > Windows Update rule groups

https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/28000/PD28228/en_US/...

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community