VSE access protection blocking mcafee processes

[User16096767]

We are seeing errors like the following on our VSE version  8.8.0.2214 environment. Agent version 5.6.2.209

MCAFEE\MACOMPATSVC.EXE HKLM\SOFTWARE\MCAFEE\SYSTEMCORE\VSCORE\ON ACCESS SCANNER\MCSHIELD\CONFIGURATION\LOW\ Prevent Modification of Mcafee Files and Settings by untrusted default processes

MCAFEE\MASVC.EXE HKLM\SOFTWARE\NETWORK ASSOCIATES\TVD\SHARED COMPONENTS\FRAMEWORK\ Prevent Modification of Mcafee Agent Files and Settings by untrusted default processes Action blocked : Write

[Kenchee_etf]

Hello @User16096767 

Can you validate if those processes are excluded in your policy that is assigned to machine from ePO in

Common Standard Protection" -> "Prevent Modification of Mcafee Agent Files and Settings" -> "Processes to exclude"

located in:

"VirusScan Enterprise 8.8.0 > Access Protection Policies > Your_Policy_name" -> Workstation/Server (based on what the machine is)

And also can you check and see if the same exclusion is applied on actual machine using VSE console and let us know results.

Best regards.

[tshamim]

Hello @User16096767 ,

Thank you for contacting McAfee. This is the VSE Access Protection Rule that gets triggered.
Please login to ePO > VSE > Access Protection > Common Standard Policy > Rule name "Prevent Modification of Mcafee Files and Settings by untrusted default processes"

You can exclude the process as well. I would also request you to follow : https://kc.mcafee.com/corporate/index?page=content&id=KB73080

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[hd4ever]

Hey, it does not show the Blocking Rule <Prevent Modification of Mcafee Files and Settings by untrusted default processes>. I got the latest & greatest extensions checked but doesn't help.