ENS July full installer prevents Adobe reader in Protected mode

[pcmcis]

Thank you for your reply @Pmaquoi 

I must say that yesterday and today I had the same problem with Acrobat even though the rule was disabled on Friday. (only the AcroRd32.exe)
The Acrobat rule didn’t change on the server but I was unable to open the program on my machine. I had to manually enforce the policy on the client using the “Agent Wake-Up Call”.

[jround]

I always run the latest available McAfee products on my system, so Agent 5.6.1.298 and ENS 10.6.1 July update

Weirdly though I was just clicking about in ePO double checking the rule and didn't make any changes today but now my Adobe and Outlook previews are suddenly working again! Bizarre!

[billmoller]

So which is worse... having all my users click the middle option for Adobe, "Always open ... with protected mode disabled" (which then disables Acrobat sandboxing, which will stay disabled after any fix is published by McAfee), or excluding Acrobat from Threat Prevention?!

[chealey · Accepted solution]

Hi all - KB91657 has now been published for this issue.

[dspenceBC]

Hi,

Could you provide a link to that please? I don't seem to be able to find it either with Google (usually works) or by searching directly within this forum. The only results from the latter point back to this thread.

[chealey]

https://kc.mcafee.com/corporate/index?page=content&id=KB91657

[Pmaquoi]

Even if the  KB described the issue linked to Adobe Reader X version, it is the same case with Acrobat DC Reader latest update (2019) too. Same workaround to avoid the issue. The devs team is alrready aware of this, i checked this fact with them.

the workaround has been tested succesfully on my side on 88 test computers for ES 11.6.1 July update. As those computers have a tag called Alpha_ENS, i created a duplicated version of the Exploit Prevention policy used by those computers, introduced the workaround in it and linked then the Policy to the tag (Dynamic Policy). this let me with a full Policy on the may update computers and the workaround version on the July tester. As i enlarge the Julyu test scope on more and more computers, the policy used will adapt itself automatically.

[Pmaquoi]

the July repost version available since last night correct this Adobe issue

[SWISS]

Just Deployed ENS 10.6.1 JULY-Repost internal on 30 W7/W10 (All variants) and did not hear anything until now. 😉 Heavy PowerShell Developers etc.

Produktversion (Endpoint Security Platform)
10.6.1.1103	NOV 2018 Release
10.6.1.1124	DEZ 2018 Release
10.6.1.1125	DEZ 2018 REPOST
10.6.1.1209	FEB 2019 Release
10.6.1.1449	MAY 2019 Release
10.6.1.1607	JULY 2019 Release
Produktversion (Endpoint Security Threat Prevention)
10.6.1.1169	NOV 2018 Release
10.6.1.1208	DEZ 2018 Release
10.6.1.1209	FEB 2019 Release
10.6.1.1550	MAY 2019 Release
10.6.1.1666	JULY 2019 Release

[jround]

I am surprised McAfee have released it as 'July Repost' rather than just marking it as 'August Update' and mentioning the corrected issues considering we are now in the middle of August!