cancel
Showing results for 
Search instead for 
Did you mean: 
mkazi
Level 9
Report Inappropriate Content
Message 1 of 4

SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help ASAP

Jump to solution

SMHSTART.EXE is generating lot of events on VSE 8.8 environment which is filling the database. What could be the possible solution ?

1 Solution

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

@mkazi If your endpoint is managed, then you should do this from the VSE Access Protection (AP) policy in your ePO, because if you do not, then your changes would get overwritten at policy enforcement/ASCI. If it's an unmanaged endpoint, then you can implement the exclusion locally via the VSE console.

For instructions on how to implement an AP process exclusion via either the ePO console or locally, see KB81095.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

3 Replies
McAfee Employee akatt
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

I would imagine that they are Access Protection events which could be generating either 1092 or 1095 events.  

1092 events are for blocks

1095 events are for reporting violations that are not blocked

Using ePO's Threat Event log, check the events that are being generated, and the event will tell you the specific Access Protection rule that is being violated.  If the events are simply a report of a rule and not a block, and you have no intentions of ever setting the block for that specific rule, you could decide to turn off the reporting for that rule.

If the events are being blocked, and you need to allow the process through the rule, you can edit the rule mentioned in the event and add a process exclusion to the rule, which will cease the events.

This KB will provide further direction as well:
https://kc.mcafee.com/corporate/index?page=content&id=KB73080


Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?



mkazi
Level 9
Report Inappropriate Content
Message 3 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

SMHSTART.EXE is a HP homemanagement thing and looks like it's safe to put into the exclusion. Is that something i have to do it from the EPO policy or i can do it on the client PC it's been detected ?

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: SMHSTART.EXE is generating lot of events on VSE 8.8 environment. How can i fix this ? Need help

Jump to solution

@mkazi If your endpoint is managed, then you should do this from the VSE Access Protection (AP) policy in your ePO, because if you do not, then your changes would get overwritten at policy enforcement/ASCI. If it's an unmanaged endpoint, then you can implement the exclusion locally via the VSE console.

For instructions on how to implement an AP process exclusion via either the ePO console or locally, see KB81095.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community