I hope somebody can help me with this. We have SCCM deploying patches on whitelisted computers every month (I have made ccmexec.exe an updater). For the most part this works fine, but some patches generate this in ePO-console. Seems that the system is trying to create a folder in C:\windows\softwaredistribution\download\ but is denied by AppControl. How can I allow Write in this folder?
|Event Display Name||File Write Denied|
|Event File Name||C:\windows\softwaredistribution\download\94a84b80b8b45a1ac53a0e5d085513da0f09965 5|
|Event Generated Time||Feb 1, 2013 3:35:29 AM Central European Time|
|Event Seq No||4,370|
|Generated by an Updater||No|
|Generated in an Update Window||No|
|Object Name||C:\windows\softwaredistribution\download\94a84b80b8b45a1ac53a0e5d085513da0f09965 5|
|Performed By||NT INSTANS\SYSTEM|
|Reason||McAfee Application Control prevented an attempt to modify this file because this file is whitelisted. To make changes to whitelisted files, define a policy with the relevant rules.|
|Reconciliation Status||Not yet Reconciled|
|User Name||NT INSTANS\SYSTEM|
Please create a Service Request and attach gatherinfo from the affected end-point. This would generally happen if updaters are not correctly configured.