3 Replies Latest reply: Apr 17, 2008 7:07 PM by Grif RSS

    VirusScan 8.5i "Prevent mcAfee services from being stopped" issues


      we are using VirusScan 8.5i with Patch 5 with "Prevent McAfee services from being stopped" setting enabled. McAfee help file says that users with Debug privileges can still stop mcAfee services even when this setting is enabled. and, Administrators have Debug provileges bydefault.

      in my scenario, I logged in using administrator account and tried to stop the McShield "McAfee Framework Service" and I got the error:
      "Error 5: Access is denied."

      is this a bug or, do I need to do anything else?

      please note that I am trying to script agent installation to remotely execute on multiple servers, and without being able to stop mcAfee services remotely (via vbscript), my script will fail...and we MUST have "Prevent McAfee services from being stopped" setting enabled as per standards :(

      any help would greatly be appreciated.

        • 1. RE: VirusScan 8.5i "Prevent mcAfee services from being stopped" issues
          It should be possible on an individual computer bases, one at a time, while sitting at the computer...Did you try:

          As an admin user, RIGHT click on the McAfee shield in the lower right corner, choose "VirusScan Console", then click on the "Access Protection" listing. When the Access Protection window opens, UNCHECK the box in the lower left corner which says : "Prevent McAfee Services From Being Stopped", then click on Apply, then OK.

          If you're trying to do this remotely, then I'm not sure you can have your cake and eat it too. If you need "Prevent McAfee Services From Being Stopped" to be enabled, then you can't have it "disabled" at the same time.

          In addition, the knowledge base article below might lead in the right direction for Group Policy issues:

          ERROR: Windows error code 5: Access is denied., Error API: RegDeleteKey, Troubleshooting code: 101

          Hope this helps.

          • 2. RE: VirusScan 8.5i "Prevent mcAfee services from being stopped" issues
            I agree that it can be done manually using steps outlined. however, my requirement is to do it remotely via vbscript.
            as I mentioned, as per mcAfee help document, local administrator account should be able to start/stop mcAfee services even if this setting is enabled. they are not able to do so...I have checked and ADministrators group do have Debug privileges.

            this is what is mentioned in Help document:
            "Prevent McAfee processes from being stopped
            Prevent users without debug privileges from terminating McAfee processes.

            Notes and Tips
            Users with debug program privileges can still stop McAfee processes even though you select this option.
            Administrators have debug program privileges by default for Windows XP and Windows 2003 operating systems. Remove these privileges from the user’s permissions so that they cannot stop McAfee processes. "
            • 3. RE: VirusScan 8.5i "Prevent mcAfee services from being stopped" issues
              Well...good luck..

              I'll point you to your own statements as well as the Help documents notes:

              "local administrator account" refer to users on the local machine, not remote users.. But maybe someone else here has done it.. Maybe they've got a solution for you.

              Hope this helps.