Installing via PSEXEC hangs in McAfee ENS

[KingInTheNorth]

ENS appears to be preventing things from being installed remotely via PSEXEC. When I turn ENS off on the system the installation proceeds successfully. No errors or blocks show up in ENS, so I am having trouble identifying which signature or settings is blocking it. 

We are using ePO 5.10 and ENS 10.7.x.

Please advise on how to pinpoint what is blocking PSEXEC from running.

Thank you in advance.

[Sivakumar1]

Thank you for the post @KingInTheNorth . What are the features do you use with McAfee ENS ?. Do we use Exploit Prevention ?. Could you please turn off exploit prevention Feature In OAS settings and check with any one machine and Try with executing the PowerShell script and check whether it gets executed.

[KingInTheNorth]

This made no difference. Threat events reports services.exe executing psexesvc.exe (Signature 70412) but it is a warning and not blocked. Though Windows Event Viewer is reporting this as an error at the same time the installation fails. It is as if McAfee says it is not blocking it, but is blocking it.

Signature 70412, 70411, 70410 are all set to report only.

[ktankink]

Hi @KingInTheNorth

Please be aware of this documented issue that may be related.

KB94701 - Endpoint Security installation fails when the installer is called remotely
https://kc.mcafee.com/corporate/index?page=content&id=KB94701

[KingInTheNorth]

Though there may be some relation to the issue. We are not trying to install or upgrade ENS we are updating various products like Chrome, Java, Firefox on the systems.

[Sivakumar1]

Thank you for your Post @KingInTheNorth . Could you please help us with more information on the  signatures you have mentioned [ Signature 70412, 70411, 70410 ]  How did we disable it?. We would also need to analyze the ENS and we would require the logs for that l because we might have to find out the component which is blocking it. Do we have ATP [Adaptive Threat Protection ] Enabled?.

[AdithyanT]

Hi @KingInTheNorth,

Thank you or your posts and updates. May I know what product is being used?

If it is ENS, Signature 70412 does not belong to our default exploit prevention signatures, meaning this must have been a part of a customer rule crated at your end. Please help us with Event details and the rule details to assist you further on this.

What if the rules are set to neither block nor report? or if exploit prevention is turned OFF? Does the issue still occur? You have mentioned that you "turned Off" ENS. Can you be more specific on the same as to what component was turned of here?

[AdithyanT]

Hi @KingInTheNorth,

Just noticed that you have turned off Exploit Prevention as well and there is no effect. Kindly please help us with "what was turned OFF" to have the issue go away at your end.

[Sivakumar1]

Thank you for your Post @KingInTheNorth . Could you please help us with more information on the  signatures you have mentioned [ Signature 70412, 70411, 70410 ] . Did we create those signatures?. How did we disable it?. We would also need to analyze the ENS and we would require the logs for that  because we might have to find out the component which is blocking it. Do we have ATP [Adaptive Threat Protection ] Enabled?.