We are observing BSOD when Applicationcontrol was set to enable mode from update mode.

[Former Member]

We are observing BSOD when Applicationcontrol was set to enable mode from update mode.

The solidcore logs shows inventory corrupt messages  and also shows can not recover inventory messages .

The issue seems similar to the  Mcafee  article -  KB88222.

Our  system configuration is-

ePO- 5.3, ENS-10.5, ApplicationControl- 8.0.0, MA- 5.0.4

we tried the steps mentioned in KB88222, still the BSOD issue is observed. 

We are not sure how the inventory got corrupted.

We can not upgrade the system currently to latest ePO, ENS, Solidcore/ApplicationControl.

Please advise.

[Former Member]

Hello,

Thank you for reaching out to the Mcafee community.

As a quick solution

1)you disable the solidcore as per the below article,

2)then you can uninstall solidcore,

3)after that reinstall it again, and

4)finally solidify the system in Observe/update mode.

5)Then try to change the mode to enable mode.

How to disable Application and Change Control manually
Technical Articles ID: KB85958
https://kc.mcafee.com/corporate/index?page=content&id=KB85958

I hope this helps, let us know if you have any queries.

[Former Member]

Hi,

Thanks for your reply and suggestion.

We will try the suggested activities  in one system  and let you know the status.

We also want to know that, why the Solidcore inventory got corrupted and how it happens ?  Please provide some information for the causes of  inventory corruption.

At site/plant  there are  approximately 100 systems  which are running  under ePO-5.3.2,  with ENS-10.5, solidcore/ApplicationControl – 8.0.0, MA-5.0.4.

From last  8 months  in all the systems solidcore installation done. Then  all the systems were kept in  observe mode.  Whitelisting was already done in ePO.

As a scheduled plan, in some systems site team started  changing solidcore  from observe mode/update mode  to enable mode. This was done  for some systems only.  But BSOD issue is observed while setting to enable mode.

In some systems which were running in enable mode already,  for any purpose if system is rebooted it goes to Blue screen.

In both the BSOD issue scenarios,  when system  reboot and  comes  to  normal, but solidcore logs shows inventory corrupt and inventory cannot be recovered.

At site this issue is observed in more than 15 systems till date.

So we are not sure how solidcore inventory got corrupted in all the systems and how to recover form this issue  without  uninstalling and re-installing of solidcore ?

As re-installing of ApplicationControl/Solidcore  will make  a  re-work again which was done 8 months back. This will not be an  acceptable workaround or solution.

So please provide if any other workaround available  to clear the corrupt inventory from all systems without uninstall, reinstall  procedure ?

Please advise.

Thanks.

[mlajoie]

we had a similar issue where we upgraded to WIndows 1909, closed update mode and ended up blue screening over 100 machines. We were able to get into safe mode and boot them back to observe mode pretty easily (as per that KB) so it's a good trick to keep in your pocket. We did not observe corrupted inventories on those machines, though.

We believe that our re-solidify tasks (as per KB86551 and KB91257) did not work (for various reasons). We know that if you don't re-solidify those machines and enable them again, they will blue screen again (we had it happen before we realized what was going on).

So...in my experience, all you should need to do is re-solidify those machines. No further installation should be needed. You may need to delete the existing inventory, though (as per KB88222).

Hope that helps.