we are using VirusScan 8.5i with Patch 5 with "Prevent McAfee services from being stopped" setting enabled. McAfee help file says that users with Debug privileges can still stop mcAfee services even when this setting is enabled. and, Administrators have Debug provileges bydefault.
in my scenario, I logged in using administrator account and tried to stop the McShield "McAfee Framework Service" and I got the error: "Error 5: Access is denied."
is this a bug or, do I need to do anything else?
please note that I am trying to script agent installation to remotely execute on multiple servers, and without being able to stop mcAfee services remotely (via vbscript), my script will fail...and we MUST have "Prevent McAfee services from being stopped" setting enabled as per standards :(
It should be possible on an individual computer bases, one at a time, while sitting at the computer...Did you try:
As an admin user, RIGHT click on the McAfee shield in the lower right corner, choose "VirusScan Console", then click on the "Access Protection" listing. When the Access Protection window opens, UNCHECK the box in the lower left corner which says : "Prevent McAfee Services From Being Stopped", then click on Apply, then OK.
If you're trying to do this remotely, then I'm not sure you can have your cake and eat it too. If you need "Prevent McAfee Services From Being Stopped" to be enabled, then you can't have it "disabled" at the same time.
In addition, the knowledge base article below might lead in the right direction for Group Policy issues:
I agree that it can be done manually using steps outlined. however, my requirement is to do it remotely via vbscript. as I mentioned, as per mcAfee help document, local administrator account should be able to start/stop mcAfee services even if this setting is enabled. they are not able to do so...I have checked and ADministrators group do have Debug privileges.
this is what is mentioned in Help document: "Prevent McAfee processes from being stopped Prevent users without debug privileges from terminating McAfee processes.
Notes and Tips Users with debug program privileges can still stop McAfee processes even though you select this option. Administrators have debug program privileges by default for Windows XP and Windows 2003 operating systems. Remove these privileges from the user’s permissions so that they cannot stop McAfee processes. "