McAfee Endpoint Security Issue: Exploit Prevention is disabled.

[hmbdtx]

I am running Windows 10 with all current updates and McAfee EndPoint Security 10.7.0.753.8 I get the following error when I view my Endpoint security status. McAfee Endpoint Security Issue: Exploit Prevention is disabled. Does anyone have any ideas as to how to resolve this issue? Howard

[patrakshar]

Hi @hmbdtx 

If you open the ENS console, do you see Exploit prevention actually disabled or it is enabled only? Can you take a screenshot of Security status and also the ENS console>EP status and post here?

[hmbdtx]

I should have stated in my posting that I am not running EPO. I am running Endpoint Security in standalone mode.

I have attached a PDF that I believe shows the information you requested.

Can you tell me exactly where in the console I can see if Exploit prevention actually disabled or it is enabled?  I cannot seem to find it.

Thanks

Howard

[patrakshar]

Click on threat prevention and you will see all the settings which includes Exploit prevention.

[YashT]

Hello @hmbdtx ,

To verify if the policy is enabled on single system:

Login to EPO > system tree > select the system on which you are getting error> Actions> Directory Management > View Assigned policy.

Select Endpoint security threat prevention in product > within category > exploit prevention > click on the policy which is assigned.

Verify if the check box is selected for enable exploit prevention.

To verify if the policy is enabled for complete organization/Subgroup:

EPO> System tree > select the group you want to check> click on assigned policies > exploit prevention policy> verify if the check box is select for enable exploit prevention.

If not enable and then do a wake up agent to all the system so they will receive new policy.

[hmbdtx]

I believe that I found what you are talkng about. Please see attached PDF.

It appears to show disabled in the console.

Should this be enabled and do you know why it is not currently enabled?

Thanks

Howard

[patrakshar]

You are right. Please enable it and check the status.

[hmbdtx]

I enabled it and the status now checks OK. Would it being disabled be the the reason why the Windows Action Center keeps poping up a message "Virus Protection is out of date. Tape or check to update McAfee Endpoint Service".?

Thanks

Howard

[patrakshar]

That is bit different issue. We have seen this issue with 10.7.0 and it is fixed in February update of 10.7. 

https://docs.mcafee.com/bundle/endpoint-security-v10-7-x-ens_10.7.0_feb_update_rn-release-notes/reso...

Interoperability ENSW-28917 Windows Defender status now correctly shows disabled when Endpoint Security is installed on the system.

You can install this specific version of ENS 10.7 and that should resolve the pop up issue. 

[hmbdtx]

Just as an FYI I have already installed  the February update of 10.7 and that is when this issue started to pop up.