cancel
Showing results for 
Search instead for 
Did you mean: 
yej
Level 7
Report Inappropriate Content
Message 1 of 10

Mcafee access protection is blocking cumulative windows updates

I recently deployed windows 10 in our network, I noticed that windows cumulative update keep failing on the windows 10 machines.  If I disabled the access protection on the machine then the update will install.  I am using the ePO 5.3 to manage all my machines.  Does anyone know what setting I need to change to fix this issue?

9 Replies
tao
Level 13
Report Inappropriate Content
Message 2 of 10

Re: Mcafee access protection is blocking cumulative windows updates

Is anything logged in the VSE access protection log (\ProgramData\McAfee\DesktopProtection)?

yej
Level 7
Report Inappropriate Content
Message 3 of 10

Re: Mcafee access protection is blocking cumulative windows updates

This is the log that was captured during the update install:

12/14/2016 9:12:42 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\VSTSKMGR.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

12/14/2016 9:12:42 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\MFEANN.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

12/14/2016 9:12:43 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MCSHIELD.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

12/14/2016 9:12:43 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\VSTSKMGR.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

12/14/2016 9:12:43 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES (X86)\MCAFEE\VIRUSSCAN ENTERPRISE\MFEANN.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

12/14/2016 9:12:43 AM Blocked by Access Protection rule NT AUTHORITY\SYSTEM C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MCSHIELD.EXE Common Standard ProtectionSmiley Tonguerevent termination of McAfee processes Action blocked : Terminate

I also noticed that disabling the access protection will work half of the time on installing the update. In order to guarantee the update installed, I have to disable the access protection and the access scan.

tao
Level 13
Report Inappropriate Content
Message 4 of 10

Re: Mcafee access protection is blocking cumulative windows updates

Are any of your Access Protection Policies set to block and not log?

yej
Level 7
Report Inappropriate Content
Message 5 of 10

Re: Mcafee access protection is blocking cumulative windows updates

No, any policies set to block are also set to report.

tkinkead
Level 12
Report Inappropriate Content
Message 6 of 10

Re: Mcafee access protection is blocking cumulative windows updates

Looking at my ePO install, we have C:\Windows\System32\Svchost.exe in the "Processes to exclude" section of this particular Access Protection rule.  I believe that this is a default configuration for this rule.  I would recommend adding this exclusion for this rule and then trying again.

yej
Level 7
Report Inappropriate Content
Message 7 of 10

Re: Mcafee access protection is blocking cumulative windows updates

I was told that svhost should not be excluded because malware or virus could use it.

tao
Level 13
Report Inappropriate Content
Message 8 of 10

Re: Mcafee access protection is blocking cumulative windows updates

What is the Agent Version?

yej
Level 7
Report Inappropriate Content
Message 9 of 10

Re: Mcafee access protection is blocking cumulative windows updates

Agent version is 5.0.3.316

catdaddy
Level 20
Report Inappropriate Content
Message 10 of 10

Re: Mcafee access protection is blocking cumulative windows updates

Moved from  Corporate Support to ePolicy Orchestrator (ePO)>Discussions

For better exposure and assistance. If needed to be moved to Virus Scan Enterprise, please apprise.

By

Moderator

Cliff
McAfee Volunteer