I want to know what process is running when you hit Ctrl+Alt+Delete combination and want to change your password in Win7.
Cause now what happened is computer halts, HIP is waiting answer and OS is locked all down. Only way is to power off and I can´t get any log information....
so I can create a rule for allow password to be changed globally in HIP policy.
Not sure what you mean by "what happened is computer halts, HIP is waiting answer and OS is locked all down."
If this only occurs when IPS is enabled, you might wonder if it is caused by HIP.
Check to see if any HIP events are generated. If so, create an IPS exception.
If not, maybe there is a further problem.
Enable verbose debugging logs for Host IPS.
Obtain a full kernel memory dump while it is in that state, refer to KB66559 or http://msdn.microsoft.com/en-us/library/ff545499(VS.85).aspx
Run the McAfee WebMER tool to collect all of the logs etc.
Open a support case for further investigation.
According to Wikipedia - http://en.wikipedia.org/wiki/Control-Alt-Delete
In Windows NT, and thus on its successors, including Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008 and Windows 7, this keystroke combination is recognized (as a special system-wide "keyboard hook") by the Winlogon process, which in response instructs GINA to perform one of the following tasks: