Application Control causes a Windows error event to occur when a new USB disk is connected to a solidified client

Technical Articles ID: KB88091
Last Modified: 2023-12-12 11:33:02 Etc/GMT

Application Control 8.x, 7.x, 6.x

The following Windows error event occurs when a new USB disk is connected to a solidified client:

McAfee Solidifier prevented an attempt to modify file C:\windows\system32\drivers\USBSTOR.SYS

This error is generated and logged when an attempt is made to modify a non-Updater process. The behavior is considered normal and occurs by design.

The drvinst.exe process must be added to the Updaters list. Perform the following steps:

For standalone installations of ACC

Start the Solidifier CLI.
Type the following command:

sadmin updaters add -t DrvInst1 -p svchost.exe drvinst.exe

For ePolicy Orchestrator-managed installations of ACC
Create a Solidcore Rule Group following these steps:

Click Menu, Configuration, Solidcore Rules.
Click Add Rule Group.
Provide a new rule group name and set the Type as Application Control and the Platform as Windows.
Click Save.
Search for the rule group that you created in the previous step.
Click Edit to edit the rule group.
Select the Updater Processes tab.
Click Add.
In the Add Updater dialog window, set Binary as drvinst.exe and Updater Label as DrvInst1.
Select Parent under Condition.
Type svchost.exe for Parent.
Click OK.
Save the rule group.

Apply the Solidcore Rule Group by following the below steps:

Click Menu, Policy Catalog.
Set Product to Solidcore 7.x: Application Control and Category to Application Control Rules (Windows).
Edit an existing assigned policy for Solidcore. For example, the Windows Update rule group that includes drvinst.exe as an updater.
Click Add.
Search for and select the rule group that you created in the previous step.
Click OK.
Save the policy.
Perform a wake up to the agents and push the new rule to clients.

This article is available in the following languages:

Knowledge Center