Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
838 Views 3 Replies Latest reply: Mar 7, 2013 1:40 PM by waynediesel RSS
itjobforme Newcomer 2 posts since
Mar 5, 2013
Currently Being Moderated

Mar 5, 2013 10:09 AM

Exclude changes from Windows GPO

This may have already been asked but I can't find it. We notice that HIPS 8.0 is blocking Windows Group Policy on our servers in some cases. Is there a way to make a blanket exclusion to allow any changes that Group Policy tries to make?

  • Kary Tankink McAfee Employee 654 posts since
    Mar 3, 2010
    Currently Being Moderated
    1. Mar 5, 2013 12:33 PM (in response to itjobforme)
    Re: Exclude changes from Windows GPO

    What process is making changes that HIPS is detecting and blocking?  You'll probably need to create an IPS exception for all signatures and that application.

  • waynediesel Newcomer 39 posts since
    May 4, 2012
    Currently Being Moderated
    3. Mar 7, 2013 1:40 PM (in response to itjobforme)
    Re: Exclude changes from Windows GPO

    I would second what Kary said, you would need to find a process that was making the change on behalf of Group Policy.

     

    I have an example like this in my org where we recently pushed a registry change via GP to all endpoints with WScript.exe. There is most likely a system event log that will show where a change. I actually found this out through a VSE threat event tell ing me that an Access Protection policy that I had in report mode only was violated. When I asked about it I learned that it was done via GP.

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points