cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
mkazi
Level 9
Report Inappropriate Content
Message 1 of 4

SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help ASAP

Jump to solution

SMHSTART.EXE is generating lot of events on VSE 8.8 environment which is filling the database. What could be the possible solution ?

1 Solution

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

@mkazi If your endpoint is managed, then you should do this from the VSE Access Protection (AP) policy in your ePO, because if you do not, then your changes would get overwritten at policy enforcement/ASCI. If it's an unmanaged endpoint, then you can implement the exclusion locally via the VSE console.

For instructions on how to implement an AP process exclusion via either the ePO console or locally, see KB81095.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

3 Replies
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

I would imagine that they are Access Protection events which could be generating either 1092 or 1095 events.  

1092 events are for blocks

1095 events are for reporting violations that are not blocked

Using ePO's Threat Event log, check the events that are being generated, and the event will tell you the specific Access Protection rule that is being violated.  If the events are simply a report of a rule and not a block, and you have no intentions of ever setting the block for that specific rule, you could decide to turn off the reporting for that rule.

If the events are being blocked, and you need to allow the process through the rule, you can edit the rule mentioned in the event and add a process exclusion to the rule, which will cease the events.

This KB will provide further direction as well:
https://kc.mcafee.com/corporate/index?page=content&id=KB73080


Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?



mkazi
Level 9
Report Inappropriate Content
Message 3 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

SMHSTART.EXE is a HP homemanagement thing and looks like it's safe to put into the exclusion. Is that something i have to do it from the EPO policy or i can do it on the client PC it's been detected ?

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

@mkazi If your endpoint is managed, then you should do this from the VSE Access Protection (AP) policy in your ePO, because if you do not, then your changes would get overwritten at policy enforcement/ASCI. If it's an unmanaged endpoint, then you can implement the exclusion locally via the VSE console.

For instructions on how to implement an AP process exclusion via either the ePO console or locally, see KB81095.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator