Help with policy exclusion

[bkesting]

Running ENS 10.6.1 with ePO 5.10.

I have a server that collects and stores uploaded video. I connect to that server via browsers from client machines to view video. When we try to export the video (download to local computer or burn to disc), we get a violation of an Access Protection Rule:

NT AUTHORITY\SYSTEM ran SYSTEM:REMOTE, which tried to access

W:\(path)\autorun.inf, violating the rule "Remotely creating autorun files" and was blocked.

If I disable the rule regarding "remotely creating autorun files" under Access Protection, then I can export video from my clients.

I've tried everything I can think of for file exclusions inside that rule, and I cannot get it to work without the rule disabled. Can anyone provide any assistance?

In the ePO forum, I posted this, and was told there is no way to exclude processes from System:Remote.

Thanks

[jess_arman · Accepted solution]

@bkesting The advice you were given that there's not a way to exclude remote processes specifically, was correct. The "process" that is violating your rule and what is being blocked is SYSTEM:REMOTE. As such, the only way to get the rule to cease being triggered would be to exclude SYSTEM:REMOTE. However, since the purpose of this rule is to block remote creation of autorun files, excluding this would negate the purpose of the rule. As such, if you're needing to allow this behavior, you will have to decide which is more important, and perhaps look at an alternative way to achieve your desires for either side of the equation.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?