Endpoint somehow blocking extract for unattended install

[daveg1978]

I am not even sure if this is the right place for this, we recently added MVISION Endpoint and EDR to our EPO server.  Most settings are default but we have played with a few.  The main thing that is happening is this:

We are trying to create an unattended install package for Citrix VDA using PDQ Deploy, this fails and gives a generic msi code that helps with nothing.  When breaking it apart and running the extract from the msi ourselves (using powershell), all files show up but the setup folder doesnt.  For some reason it is blocked from the extract, we have gone through the threat event logs and found nothing.  PDQ logs tell us nothing, we have searched and searched and still cant find the exact issue.  But when we uninstall MVISION Endpoint from the computer, the extract works as intended and all files show up.

Any help at all would be appreciated, where to look, what we could be doing wrong, policy settings.  Right now we are looking at our policy settings and general settings and from what it looks like everything is in audit mode, yet it is still failing...

We are running EPO server 5.10 with MVISION Endpoint 2006, we also have MVISION EDR on there for reporting but that is mainly to control end devices for quarantine and investigation.

[hnegishi]

Hi @daveg1978 ,

Thanks for your post.

To investigate this issue, it seems to be needed MVE debug log.

You can set Debug Log Level on "Log Settings across MVISION Endpoint" in MVISION Endpoint General policy.

After enforced the changed policy, please reproduce this issue and collect a MER log.

You can submit a new Service Request with the MER log following the below information.

ServicePortal Help and FAQ

> Submitting a Service Request