1 of 1 people found this helpful
McAfee does protect it's own directories from being altered. which could happen with an infection, it's called Access Protection. However, how to control that varies between home and Enteprrise and it sounds like you are using the latter. Can you clarify please what McAfee product you are using?
Thanks for your help!
I am using VSE 8.8.0p2 against McAfee ePO 5.0.1 with the latest 5600 scan engine.
I think I know which access protection settings your talking about... the ones in common standard protection, right? I hate to turn those off, but perhaps if I do so temporarily and allow the settings to apply all would sort out... until I build another box that is!
Of course I could always create GPO settings to create the empty folder if it doesn't exist as part of my build process, apply the settings, and then pushout via ePO....
Sorry, I'm new here, it seems I posted this in the home and home office section... feel free to move it to VSE.
OK I know nothing about most Enterprise products so have moved this provisionally to ePO for better support.
It sounds like you figured out what I would agree is the best answer. Disable that Access Protection setting until the GPO settings take affect. As for new machines, this is where you could be creative and use some tagging to help automate the process. It all depends on your current setup, how you use the System Tree etc., but maybe you can get an idea from this. Any time a new system is added to the system tree, have it tagged as a new system. Use a Policy Assignment Rule to assign a VSE policy with that AP rule disabled. Depending on how your GPOs are applied, you could change the tag either the next day, or based on some other means, to a tag that applies your standard VSE policy with the AP rule back in place. You can really extend this logic to do other things, quarantine a new system until all products are installed that you own, etc.
Thanks Chris. I am not too savvy with the newer 'tagging' feature of ePO but should be able to figure it out. I like the idea of being able to target the reduced AP setting rather than turn it off across the board, even temporarily.