1 Reply Latest reply on Apr 7, 2016 10:47 AM by dmeier

    Block **\*.scr User Defined Access Protection Rule deny read when not set to block read


      Ever since updating to VSE 8.8 Patch 7 I keep getting alerts through Automatic Responses triggered when this AP rule is violated. The problem is, events are coming in with "action taken: Deny read" when we do not have deny read set in that rule. This is causing a lot of unnecessary events to come through, and in turn it causes these machines to be quarantined. This never happened on VSE 8.8 patch 2, nor does anything come in with Deny Read on any machines still on patch 2. Is this a bug with Patch 7? It is causing a lot of unnecessary "panic" due to all these alerts coming in.


      We are on Agent v4.8.0.1938, ePO server is 5.3.1 build 188, fully up to date w patches, latest VSE management and reporting extensions.