File Write Denied

[mlajoie]

Good morning.

We are trying to replace a file (C:\WINDOWS\PSEXESVC.exe) but we are getting file write denied.  I cannot skiplist \WINDOWS\ so is there a better way to allow that file to be replaced?  

We're just copying/pasting the new file onto the old one.  

Please advise of a possible better way.  Thank you.

[yaz]

Hi @mlajoie 

Thank you for reaching out to McAfee Community.

From the provided details, we understand you are looking for possible skiplist option to exclude this event.

You can test locally for this file only. 

sadmin skiplist add -d <path component>

Details available in the product guide below. 

https://docs.mcafee.com/bundle/application-control-8.0.0-product-guide-unmanaged/page/GUID-25138B14-...

Was my reply helpful?

If yes, please give me a Kudo. If I have answered your query, kindly mark this as solution so that we help other community members together. 

[mlajoie]

i thought -d was relative path and folder only -- not a specific file.  Am I mistaken?  The product guide doesn't provide an example.

[Pravas]

Hi @mlajoie ,

You're correct, it uses a relative Path. If you were to add a skiplist for File Write Denied, it will be as follows.

skiplist add -d \Windows

Since the target path is Crucial to windows, its Not a good idea to use Skiplist.

The reason PSEXESVC.exe can't be replaced because its probably Solidified and is protected by SolidCore.

Incase the file is being replaced using Copy & Paste, then the source process is Explorer.exe. As its a generic process it can't be excluded or used as an Updater as well.

Here's something you can try:

1. Change SolidCore to Update Mode

2. Replace the file

3. Switch back to Enable mode

Hope it helps.

[mlajoie]

Yeah -- all of that makes sense and is inline with my thinking as well so that's good.

i did, though, just have a thought.  what about if we unsolidified the file first?  would that work?  if so, what would that look like?

Also, if that would work, what would happen with the new version of the file?  Would we need to resolidifiy it or would a rule that has the hash in it allow it to work?

[Pravas]

Hi @mlajoie ,

Yes, you may choose to un-solidify the file. Then replace it with the desired version.

Then PSEXECSVC.exe can be Solidified.

Or

You can allow the binary using SHA1 or SHA256 in Executable Files.

Hope it helps