Mcafee threat prevention blocking support screen connect session

[#1]

Our deskside team reporting that screen connect sessions for user support are being blocked for some reason. When support team launches screen connect session a file screenconnect.exe is trying to install on the system to allow access to support staff. For some reason recently we started seeing it being blocked. I would like to whitelist the file, I tried doing that on Threat Prevention but for some reason its still not working. Please assist in getting in resolved.

[savidudu]

 First need to identify which module is blocking.

try disabling the modules on be one and see when you are seeing the issue.

else you can check the logs.

You can also try to open a Service Request with the support to get this fixed asap.

also this should be posted in the right channel which is ENS:

https://community.mcafee.com/t5/Endpoint-Security-ENS/bd-p/endpoint-security

Thanks

[aguevara]

I will move this post to that channel now for proper visibility

[BSharma]

HI ,

Can you confirm if the reported file "screenconnect.exe" was detected as malicious or as PUA (potential unwanted Application). 

To exclude the file from On Access Scan, refer below steps: 

Configure exclusions for ePolicy Orchestrator (ePO) managed computers at the following location:

1. Log on to the ePO console.
2. Click Menu, Policy, Policy Catalog.
3. Select Endpoint Security Threat Prevention from the Product drop-down list.
4. Select On-Access Scan from the Category drop-down list.
5. Click the policy name.
6. Click Show Advanced.
7. Navigate to the Process Settings section, Exclusions list.

Ref: https://kc.mcafee.com/corporate/index?page=content&id=KB88807

Was my reply helpful?
If Yes, please give me a Kudo. 
If I have answered your query, kindly mark this as solution so that we help other community members together.