Powershell scripts failing after getting ATP installed on WIndows servers

[Sabarikumar]

Team, We recently installed ATP in Observe mode on windows servers after which we notice Powershell scripts are getting blocked.

Attached screenshot got some errors noticed in the "EndpointSecurityPlatform_Errors" logs file. 

Also i see errors related to Real protect cloud scanner in "ATP Activity logs"

Could someone please help with this? 

Thanks in Adavance, 

Sabarikumar KB

+91-9148194772

[Pravas]

Hi @Sabarikumar ,

ATP in observe mode shouldn't block any scripts. Please refer to the Events tab of Endpoint Security to verify whether it was blocked by ATP or other module.

Alternatively please refer to the "AdaptiveThreatProtection_Activity.log" found in the location below.

C:\ProgramData\McAfee\Endpoint Security\Logs

Please also create a service request with MER logs for further investigation.

https://kc.mcafee.com/corporate/index?page=content&id=KB59385

Thanks

[Sabarikumar]

Thank you Pravas for your quick reply. I dont see any block message or error related to Powershell in ATP logs. The only place where i see powershell related entries are the EndpointSecurityPlatform_errors logfile.
I understand that should not block anything when in Block mode. But as soon as we uninstall ATP., the powershell files runs as expected.

[Pravas]

Hi @Sabarikumar ,

If there are no block events in ATP then we may need deeper investigation.

Please raise a ticket with McAfee tech support for further analysis.

Thanks