cancel
Showing results for 
Search instead for 
Did you mean: 
GdB
Level 8
Report Inappropriate Content
Message 1 of 6

ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

Hi everyone,

 

I wanted to ask you all wether you already came close to an issue we are seeing rigth now :

We have ENS 10.5.5 and we try to execute a Powershell script with the Windows cmd. Yet there is one PS line that leads to a crash of Powershell.exe.

The problematic line is :

  • New-ItemProperty -LiteralPath HKLM:\SOFTWARE\test\USRPKGS -Name '(default)' -Value 'test' -PropertyType String -ErrorAction 'Stop'

 

If we launch the script from the Powershell ISE everything works fine.

But if we want to launch it from the cmd then Powershell crashes.

 

We were able to reproduce the bug with ENS 10.6.1, with ENS 10.5.4 no problem.

 

Do you have any idea of the root cause? Or a fix ?

Thank you,

GdB

2 Solutions

Accepted Solutions
GdB
Level 8
Report Inappropriate Content
Message 5 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

We got a new signature (number 9286)  for Exploit Prevention and the problem seems to be resolved.

We will go further and test it on the numerous crashing machines.

 

Thanks for your involvement in this question, and thanks for your time.

Cordially, GdB.

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

That's great news. To share some more details on this for other customers who may read this - in certain environments we have seen issues with two new signatures implemented in the May Update content. If you are seeing Powershell crashes seen since 14th May, please reach out to our Technical Support Team for further assistance.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
5 Replies
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

This could potentially be linked to the latest Exploit Prevention Content which was released a few weeks ago. I would encourage you to raise a Service Request with Technical Support for this issue.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
GdB
Level 8
Report Inappropriate Content
Message 3 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

Well we issued a ticket to the support, I was hoping that we weren't the only ones in this special case. Furthermore a public response here in the forum could help a few people in the future.

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

@GdB In the vein of public discussion; can you confirm that the issue resolves when you disable Exploit Prevention? This way, we can confirm component involvement of that feature, and by your confirmation allow others to know a way to immediately work around the crash if they need have a need to do so.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

GdB
Level 8
Report Inappropriate Content
Message 5 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

We got a new signature (number 9286)  for Exploit Prevention and the problem seems to be resolved.

We will go further and test it on the numerous crashing machines.

 

Thanks for your involvement in this question, and thanks for your time.

Cordially, GdB.

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 6 of 6

Re: ENS 10.5.5 conflicting with Powershell command executed with cmd

Jump to solution

That's great news. To share some more details on this for other customers who may read this - in certain environments we have seen issues with two new signatures implemented in the May Update content. If you are seeing Powershell crashes seen since 14th May, please reach out to our Technical Support Team for further assistance.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator