I have built out numerous rules to monitor/block services from stopping and
starting to no avail. These rules, once created, are verifed that they are
on the system via registry. Currently I have the rule set to anything:
Rule { tag "Service Protection" Class Services Id 4149 level 4 display_names { Include "&" } directives services:stop services:start }
Nothing even shows up regarding this rule in the HipShield.log on any
system that I try this on. I have tried all different severity levels with
no change. My main test is with the Adobe Updater so the rule typically
looks like this:
Rule { tag "Service Protection" Class Services Id 4149 level 4 display_names { Include "AdobeARMservice" } directives services:stop services:start }
I have also tried using 'Service' as opposed to 'Display Name' and using
"Adobe Acrobat Update Service" as well as ANY service (see below) with no
triggering.
Rule { tag "Service Protection" Class Services Id 4149 level 4 services { Include "&" } directives services:stop services:start }
I am using HIPS 11.0.500.582 on Windows 10 managed by ePO 5.3.2.
All other features of HIPS are functioning and any other rule created will fire as designed. If we monitor the use of the executable that launches the service, that does work, however we need the Operations that are provided with a Service rule type.
Please be aware of:
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA