Exploit Prevention WebMer - ESConfig

[cheetah]

@AdithyanT or @Dayananda  Sorry, but just one last question:

But the data collected by MER.exe are NOT incorrect either - due to the actual block of the AP rule?

[AdithyanT]

Hi @cheetah,

Firstly, my apologies for the delay as I was OOO for a week's time. Your question is very much valid and I did not really check that part. Our recommendation is to ensure we exclude it, and I am currently generating MER with and without this block turned ON. Should I see a difference in output missing crucial DB information (I am already guessing what I could miss with AP rule ON), I will have a public facing KBA written and publish for your and our other customers who may be facing this issue.

Once again, my apologies for the delay in response. I request you for possibly a few more hours while I get this tested for you.

[AdithyanT]

Hi @cheetah,

Thank you for your kind time and patience with us.

So, I have examined the use of ESConfig here and I can see that there are policy exports that is being created for each of the components present in your machine while collecting MER (Components like TP, WC, etc.)

Although these come in real handy when exploring individual policies applied on the endpoint, This may not be a deal breaker when we are checking in the overall setting using the registry exports and other issues that may not really require us investigating the policies in depth.

Missing files from the MER where AP rule was blocking ESconfig are as follows:

FILE_ESCONFIG_EXPORT_ESP64.txt
FILE_ESCONFIG_EXPORT_FW64.txt
FILE_ESCONFIG_EXPORT_TP64.txt
FILE_ESCONFIG_EXPORT_WC64.txt

I will see if a KBA needs to be written explicitly for this and keep you posted with an update via this community post!

Thanks you for bringing this up to our notice!