StevensNet.com

...Because someone's gotta tell the story...

Blogs

To return to the main Blog List, click Full Blog Listing.

Tags

Group Policy
SCCM
System Center

Upgrade to SCCM 1702: Blame McAfee

Tuesday, April 11, 2017 in System Center (Views: 1356)
I saw something interesting in the upgrade to SCCM 1702, although this isn't new in the product.

The problem? The extract of the 1702 upgrade package failed. Why? Upon investigating the cmupdate.log, I found that the extract failed because it couldn't create "autorun.inf". Uh-oh. This is trouble, and an old file we all know to autostart code on CDs and now DVDs.

Well, there is a GPO to block the autorun.inf, but that is only to execute and run the command in the file. Antivirus to blame, as the McAfee logs show these snippets:

Blocked by Access Protection rule
NT AUTHORITY\SYSTEM
SYSTEM:REMOTE
D:\Program Files\Microsoft Configuration Manager\EasySetupPayload\e0df5bb8-b4c8-4553-9b55-133e36536a35\autorun.inf
Anti-virus Standard Protection:Prevent remote creation of autorun files
Action blocked : Create


Needless to say, disabling McAfee Antivirus did the trick. Another mystery solved.

 

Related Blogs You May Be Interested In:


To leave a comment, please log in and/or register.