Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

re: Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

Pranay Bhagat (MCP,MCTS,MCITP) — Fri, 01 Feb 2013 07:12:03 GMT

Hi Vinayak,

Does excluding ccmexec.exe from access protection works with SCCM 2012 too.

As i have upgraded my SCCM 2012 site to SCCM 2012 SP1 & McAfee was installed on the server because of which i was not able to update the boot image.

Please suggest.

re: Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

saranrajappa — Mon, 08 Oct 2012 18:48:46 GMT

Hi,

Thank you for sharing.

I am looking at AccessProtectionLog.txt in Windows 7 SP1 with McAfee 8.8 client and the error is not there.

Is it something resolved?

re: Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

Chad A — Fri, 11 Nov 2011 16:43:33 GMT

Great article, too bad you didn't include the Data column in ProcMon that shows what rights were requested when the file handle was opened. ccmexec.exe has a nasty habit of opening all files with Full Rights just to read file properties. If Microsoft would follow their own coding best practices and open the file with only the required permissions to perform the QueryBasicFileInformation action, McAfee wouldn't care. The same thing happens with the "Hardware Inventory" that collects which EXEs/DLLs are saved to disk. If you have any tools (not just McAfee) configured to block execute file system access to known-bad file names, ccmexec.exe will never inventory those files.

re: Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

G Hari — Tue, 01 Nov 2011 16:56:49 GMT

Great work bro, you have provided a valuable info. Keep it up!!!

re: Information regarding McAfee Access protection rule and ConfigMgr 2007 ccmexec.exe behavior

Jugal Piplani — Tue, 01 Nov 2011 03:59:00 GMT

Good work vinayank. It is good article in terms of the content and topic and really helpful in troubkeshooting. You should put some tags so that it should be easliy searchable.

and Keep working.