IMPORTANT: The proper order of installation (fresh installation) is ENS first and then ACC.
To make sure that ACC and ENS can coexist on an endpoint, you must disable the ACC Memory Protection feature. You can disable Memory Protection (MP) using the following options depending on whether it's a fresh install of ACC or ENS is being installed on a system that already has ACC enabled.
Scenario 1: Deploy ACC when ENS is already on the client.
In this scenario, we suggest that the user disables the MP feature while enabling ACC. To disable the MP feature, perform the following steps:
For ePO-managed:
- To disable the MP feature while configuring the Enable task, select the MP Disabled option under the "Initial feature configuration" section.
NOTE: Disabling the MP feature in the Initial feature configuration is permanent. You can't enable it again after installation. Any change in the MP status through a policy is ignored at the endpoint.
Scenario 2: Deploy ENS on a client having ACC enabled.
ePO-Managed deployment:
The steps below detail how to use these methods to disable the feature.
- Log on to the ePO console.
- Click Menu, Policy, Policy Catalog.
- Select the Solidcore <version number>:Application Control (varies depending on the extension version) entry from the Product drop-down list.
- Select the Application Control Options (Windows) entry from the Category drop-down list.
- Click Duplicate for the McAfee Default policy, specify the policy name, and then click OK.
- Double-click the created policy, and then click the Features tab.
- Select Enforce feature control from ePO, deselect the Memory Protection option for Feature Control, and then click Save.
- Apply the policy to the appropriate endpoints.
- Perform a reboot.
NOTE: A reboot is needed to enable or disable ACC MP. Disabling the policy only sets the status, and the change doesn't occur until the next reboot. See the example below:
C:\>sadmin features list
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
mp-vasr-forced-relocation
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
NOTE: To disable MP using the
sc:run command client task, perform the following steps:
- Log on to the ePO console.
- Create a Client Task.
- Select Solidcore for the Product and select the SC: Run command for the Task Type.
- Assign the task a name, click Save, and then click Next.
- Type the following lines in the "Run Commands" section:
features disable mp
- Save the task.
- Perform an agent wake-up call and push the new task to the Application Control agents.
NOTE: For details, see
KB81202 - Agent reports Memory Protection is enabled, but the Application Control Features policy is configured to not enforce memory protection.
Perform the following steps for a Standalone Environment:
- Run the Solidifier command-line interface (CLI) on the endpoint as administrator.
- Recover the CLI if not already done using the following command: Sadmin recover.
NOTE: The user must provide the Solidcore CLI password to get it recovered. Contact your Solidcore administrator for further details.
- Execute the command <sadmin features disable mp>.
- Reboot the system.
- The system comes up with MP disabled.
- Lock down the CLI using the following command: Sadmin lockdown.
NOTE: To enable or disable ACC Memory Protection, perform a reboot. Disabling through the command only sets the status, and the change doesn't occur until the next reboot.
