Internal Error

[mlajoie]

Getting this error occasionally on different endpoints:

execution-control failed due to an internal error. blocking by default mcafee application control

It seems to happen on start-up but I cannot find anything in the logs about it.  It also does not seem to last long -- it's almost like it doesn't have the current policy or something.

[BenEllis]

What version of Application Control are you running?

[mlajoie]

Sorry.  Meant to include it.  We're running 8.3.0.303.

[BenEllis · Accepted solution]

Please test the latest 8.3.2 if still happens open a case with support. This seems to be a new issue. But i would assume the command you are running is crashing the service. But in order to tell we would need to look at the logs. Please open a case with support as this seems to be a new issue.

[mlajoie]

upgrade the client to the new version? if yes, can you provide the best way to do that? I'm a little nervous to upgrade the client. Please advise.

[BenEllis · Accepted solution]

https://docs.mcafee.com/bundle/application-change-control-8.3.x-installation-guide-windows/page/GUID...

Its a fairly simple product.

if you want to do it on one machine or manually. 

1.  download the latest zip of the client from either the download site or software manager.
2. Extract the zip 
3. Find your OS exe and double click it. 

if you need help you can always call support. We will be glad to give you a hand. 

[mlajoie]

Updated the client from ePO and received an Application Control block but I'm not sure why.

Details: McAfee Application Control prevented an attempt to modify file C:\windows\TEMP\{B1BB9F27-7E28-405D-88C1-862700E94DFD}\setup-win-8-10-2012-amd64-8.3.2.133.exe by process C:\Windows\SysWOW64\explorer.exe (Process Id: 11640, User: NT AUTHORITY\SYSTEM).

[BenEllis]

Please check the S3diag for the same error. Should tell you why. i bet its because the exe is solidified and it probably tried to clean up or something but start there. 

[mlajoie]

OK. It looks like I'm too late -- the log has been overwritten (it happened a couple of days ago).

I guess I don't understand why it would be blocked from doing whatever it needed to do because it was run from the McAfee agent -- wouldn't it be trusted with McAfee certificates and such?

[BenEllis · Accepted solution]

It should be .. but KB91662 was not added making the mcafee cert an updater.  But in this case

the block you show states explorer is trying to overwrite (typically the file is solidified, meaning protected from write or deletion.) so thats really what we need to verify first.