Application Control Default policies are blocking everything

[Former Member]

Dear Guys,

After deploying Application Control 8.2 on on all the clients we sent the SCEnable_AppCtrl_Windows_CWD task to all the clients. Our purpose was only to run inventory task and have a full list of applications in the network. The problem is that the Application Control is blocking almost every executables while our only goal was to have an inventory of applications not to block them. How is it possible to allow all the applications and executable to run? Please take a look at the below picture. We want all the applications to run and expect the Application Control just to make an inventory for us and not more yet.

Thank you in advance.

[Kenchee_etf · Accepted solution]

Hello @Former Member 

May I ask, why are you using 8.2 instead of 8.3 version especially because I think this fits better to the scenario of usage you are describing:

*** McAfee Application Control and McAfee Change Control 8.3.x - Windows Product Guide (What is Inventory mode?)
https://docs.mcafee.com/bundle/application-control-8.3.x-product-guide-windows/page/GUID-94CE62B2-580B-4BA9-8D48-9B966EE85F68.html

I hope this helps.

[Former Member]

@Kenchee_etf 

Thank you for your reply.

I actually solved the problem by putting all the clients on Observe mode. However what I am looking to find is that how to edit the Whitelist. I am able to add the found applications in whitelist but cannot find how to delete them from the list. Also it is somehow weird that on some clients even cmd.exe is blocked but on others no. Actually I did not expect such complexity in this program.

One more thing is that in comparison with Kaspersky Application Control where we face Whitelists and Blacklist mode which lets us to decide which way we look. To let only the whitelisted programs to run and block the others or let everything run except the blacklisted one. However I know that blacklisting specific apps is possible through ENS Access Protection but is it possible in Application Control as well?

Thank you in advance.

[BenEllis · Accepted solution]

Whitelist is everything that is allowed to run. This is created with Initial solidification.

You can configure your policy to ban by name/checksum or by reputation.

https://docs.mcafee.com/bundle/application-control-8.3.x-product-guide-windows/page/GUID-C0A5172B-DC...

Please go through our product guide. It should help you understand the product. You can always call into support and they will help you with certain issues. but what you are asking is very generic of the product. 

One place you can start is our landing page:

https://www.mcafee.com/enterprise/en-us/products/application-change-control/support.html

this will give you location of our documents and best practices.