6 Replies Latest reply on Aug 28, 2014 9:04 PM by ansarias

    how to find policy setting?


      We have just pushed out our ePO agents to our Windows 7 workstations.  We have Not created any ePO policies yet there were some already in place.   And we've noticed that no one, not even desktop/domain admins can modify the properties on C:\Windows on our Windows 7 machines.    how do we turn that policy off?  We have a need to modify the security on C:\Windows on many machines.


      Thank you. 

        • 1. Re: how to find policy setting?

          Presumably you are referring to the VirusScan policies? Please provide some more info. What can't they modify?

          • 2. Re: how to find policy setting?

            If you right click on your \Windows folder and choose properties\security and then try to add a user you get denied.   I've tried and I'm both a desktop and domain admin and I can't add any user or group to the security permissions on the c:\windows folder.   We need to manually install some software and it requires access to c:\windows\ and due to ePO we are unable to install this.  

            • 3. Re: how to find policy setting?

              I'm not sure this is due to ePO. Have you tried disabling the agent to see if you get the same errors? Do you have strict access protection in place? Take a look through your VirusScan policies and where they're applied. Create a test group to test new policy settings and push those policies to your test systems. Really though, this sounds like a problem with how you've locked down your windows folder via group policy or something.

              • 4. Re: how to find policy setting?

                we have a corporate Windows 7 build.  It is built via CM2012 (Microsoft's OS deployment tool) so all images are the same.  Currently the ePO agent is "not" part of the OS build process, we are installing it via scripts to select users.    On any Windows 7 workstation that does not have the ePO agent installed we can manipulate the security permissions on the C:\Windows or any folder for that matter.  But once we install the ePO agent it is restricted.  That is what made us all look to the ePO agent :-)     I've looked at the policies within the ePO console and I don't see anything that would point to this type of lock down.   So we are a bit lost here.

                • 5. Re: how to find policy setting?


                             In order to make a quick determination to prove that it isn't McAfee, try this on a test system.


                  1. From the command prompt proceed to C:\Program Files (x86)\McAfee\Common Framework

                  2. Remove the McAfee Agent: (This allows for the proper communication between the client and the ePO Server. The agent is the vehicle for getting policies to the client from ePO.)


                  3. If necessary disable the on-access scanner and access protection.


                  Please let us know and we will try to assist.

                  • 6. Re: how to find policy setting?



                    There no such policy in McAfee to block modification on C:WINDOWS folder, to make sure refer McAfee Access protection logs and see if there is any block to this folder by McAfee.