@mr @xaba_sg
It is worth noting that we seem to be discussing two, possibly related, but different issues here.
1. The ability for applications to "hook" McAfee processes, aka perform dll injection
2. Configuring the On-Access Scanner to ignore disk activity of a given process, and thereby prevent scanning of everything that process performs (disk read/write).
@xaba_sg
Citrix allows for excluding certain applications from being "hooked" by their processes, but as I understand it, this is only for child processes of the Citrix application. The core, or parent, processes cannot be configured to prevent their injection...the application would lose functionality. Every so often, McAfee has to gather the certificates for these parent dll's used by Citrix, and then add them to the McAfee Trust Certificate store, in order for McAfee products to "trust" that the injected Citrix dll's are indeed legitimate dll's, allowing use in some way of McAfee processes, and also confirming that the dll injection is non-malicious (not Malware). Note, that, dll injection into a McAfee process doesn't necessarily mean that either the McAfee application, nor the injecting application, may experience an issue; It is too difficult to project what might occur when allowing 3rd-party applications to inject into a McAfee process. Generall, though, for Citrix it does not cause a product functionality loss for their software, nor McAfee software, when allowing the injection, but if we do not already trust the dll that is attempting injection, you could experience things such as McAfee software patch/upgrade/install failures (due to routine installer checks that occur during install). If there are any unstrusted-by-McAfee dll's within your environment that you feel should be trusted by McAfee, or that might be causing an issue, we can start the review of those dll's through opening a support service request. We will need the digitial certificate of the dll's which are injecting, to start the review process and determine whether or not we can sucessfully add them to the McAfee Trust Certificate Store.
@mr
The issue described has to do with logon performance. One of the common items related to logon performance with Citrix, and McAfee software that performs scanning (VSE/ENS/MOVE), is due to the scanners monitoring the disk activity of UserProfileManager.exe. In fact, some years back, we went ahead and added this process as a process exclusion within MOVE default policies (in ePO), as support would commonly help customers perform this process exclusion with MOVE, and all logon performance degredation would cease. This isn't something we have done with product such as VSE/ENS, and as such we must manually configure it. I would be curious to see all of the details regarding this specific support case, as there are a couple of aspects regarding the usage of "low-risk" that I find are misinterpreted, or perhaps just overlooked, commonly.
In order to sucessfully use low-risk process polices (for what they are normally intended, aka a "process" exclusion) we must:
--Enable the feature to use Default, Low, and High-risk process policies (this is within the Default Processes policy for VSE, and within the On-Access Scan advanced options for ENS)
--Add the process name to the low-risk processes policy (example: test.exe)
--Within the low-risk processes policy, disable scan on read and scan on write (NOTE: for UserProfileManager.exe, we could probably just disable scan on read, as I believe most of the logon disk activity is read activity).
Personally, I commonly find that either item 1 was never enabled, but since ePO allows for modifying the low-risk settings without enabling the option, the low-risk settings never apply to the systems for which they are intended). Or, I commonly find that the exe is added as a file exclusion within the Default Process Policy. The latter, simply tells the product to ignore that single file on disk, whereas performing the "process exclusion" using low-risk, tells the scanners to ignore all disk read/write activity for the added processes.
Hopefully, this helps explain a bit more in detail.
Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
You Deserve an Award
