McAfee Default Policy applied at My Org or Global Root

[User41804773]

Does the McAfee Default Policy override the duplicated and customized policy that is applied at the same group (I.E. My Organization). McSHield.exe is added to customized policy. Is the source of the events McAfee Default Policy?? ISSUE: Exclusion of McShield.exe is not included in the VSE 880>AP>McAfee Default>Prevent modification of McAfee Common Management Agent files and settings. The customer is receiving >100K a day (Event ID 1092) where THREAT NAME: Common Standard Protection: Prevent modification of McAfee Common Management Agent files and settings THREAT SOURC PROCESS NAME: C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MCSHIELD.EXE THREAT TARGET FILE PATH: HKLM\SOFTWARE\WOW6432NODE\NETWORK ASSOCIATES\TVD\SHARED COMPONENTS\FRAMEWORK\

[chealey]

You can easily see which policy is applied to the machine, by navigating in ePO to the system affected. Selecting Actions > Directory Management > View effective policies

You can also check that the policy is being applied by navigating to the local VSE console.

[User41804773]

The response directs one to the determination of the applied policy. It does not directly answer the question, when the same policy name is applied My Organization and at the Global Root and a setting is 0 in the policy applied at My Organization and the setting is 1 in the policy applied at Global Root, which policy setting has precedence? Or to simplify, which policy application location has precedence, My Org or Global Root?

[cdinet]

KB85924 describes issues with global root policies missing. Basically, the global root assignments are the my default policies of the point products. When you manually assign a policy at my org level, that takes precedence.