cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Andy
Level 7
Report Inappropriate Content
Message 1 of 3

"VTP Trusted" but still blocking

Jump to solution

Hi everyone,

I am seeing around 50 alerts for various .dll's being executed by mmc, explorer, etc. with the event display name: VTP Trusted.

Description: Application Control blocked this file because it is not in the allow list. To execute this file, add the file to the allow list.

Deny Reason: Local allow list: File not present in allow list

I guess I'm a bit confused by VTP trusted. I was under the reputation that since the file was "Most Likely Trusted", it would be allowed to execute, but the description says it's blocked..

Do I just add these files to my Executable Files list?

Any advice?

1 Solution

Accepted Solutions
Tares1
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: "VTP Trusted" but still blocking

Jump to solution

Hello @Andy 

Solidcore has an execution decision workflow that will block execution if any check fails, and after checking for TIE and GTI reputation comes VTP and local Whitelist:

You can see all checks that are made by MACC and in what order on this link:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And how Reputation is computed here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And yes adding the files to the executable Files list should allow them to run depending if they don;t fail any other checks as we can see here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

 

If you still have issues, I would recommend opening a technical support case for further investigation.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Tiago A

View solution in original post

2 Replies
Tares1
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: "VTP Trusted" but still blocking

Jump to solution

Hello @Andy 

Solidcore has an execution decision workflow that will block execution if any check fails, and after checking for TIE and GTI reputation comes VTP and local Whitelist:

You can see all checks that are made by MACC and in what order on this link:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And how Reputation is computed here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

And yes adding the files to the executable Files list should allow them to run depending if they don;t fail any other checks as we can see here:

https://docs.mcafee.com/bundle/application-control-8.1.0-windows-product-guide-epolicy-orchestrator/...

 

If you still have issues, I would recommend opening a technical support case for further investigation.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Tiago A

View solution in original post

Andy
Level 7
Report Inappropriate Content
Message 3 of 3

Re: "VTP Trusted" but still blocking

Jump to solution

Thank you for the info. I'm not 100%, but I'm certain the documentation will get me much further down the road.

It's still pretty interesting to see Solidcore Events under reporting, then see completely different alerts in Policy Discovery under Application Control. Hoping the documentation will explain the differences

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community