Hi @ all,
I need to provide exceptions in the threat prevention of ENS10.5.4 managed by ePO 5.9.1 but the added item in the exploit-protection policy does not take effect.
In my case I need an exception for exploit-protection ID 413 "Suspicious Double File Extension Execution". As soon as I disable this option, I can execute my test file with multiple points in the filename.
In our "My Default" policy of "Endpoint Security Threat Prevention" I configured in the area "Exceptions" the test exception as follow:
Name: EXPLORER:EXE - as like as the name is written in the log files of the client
Filename: test.tmp.cmd - also as written in the log file
After saving an pushing this policy to my test client I test it - but it does not work. Why? Any ideas?
Furthermore - is it possible to configure a network path as exception? For example \\domain\netlog?
Here it will be better if you could please open a case with support, we need to take a look at one of the affected systems with a debugged MER (KB82170) and see why the policy enforcement is not working
thanks a lot for your help!
I opened a ticket. During I was waiting for a response from the support the server executes the policies – so I closed the ticket. A little bit strange.
Do you know if there is a bug with “force policy” in the agent event monitor or by pushing the policies by “agent reactivation” with “force policies” from ePO 5.9.1?
It seems to be a question of time. If I have to wait for any automatically processes.
What was your case number? I can take a look.
Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center