Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Technical Articles ID: KB91933
Last Modified: 2022-11-24 11:58:37 Etc/GMT

Environment

Application and Change Control (ACC) 8.2.1-407 (Update 5)
Microsoft Windows

Problem

The CMD.exe and other processes fail to start after you upgrade to ACC 8.2.1-407 (Update 5) from any version. You see the following error in the Solidcore log file:

(Rule String: Execution-Control failed due to an internal error. Blocking by default)

NOTES:

This issue affects systems that aren't using the Default "Execution Control" rule group or that have modified it.
Standalone installations of ACC aren't affected.
The system log file shows SCSRVC.exe crashing many times.

Cause

In normal processing, we validate that the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWIN\Parameters\RuleEngine key matches the process list in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SWIN\Parameters\CandidateProcesses.

When a new Execution Control rule is created, our code adds that process to the candidate process registry. If all processes from the Execution Control rule group are removed, the process is then removed from this table.

This conflict occurs after upgrading. Our installer repopulates the candidate process registry table with default processes. If the default rule group is removed or modified, it creates a mismatch between the rule engine table and compatibility table. This mismatch blocks the process.

Solution

This issue has been corrected in ACC 8.2.1-435 (Repost). Upgrade to ACC 8.2.1-435 (Repost) if you experience the issue described in this article.

Our product software, upgrades, maintenance releases, and documentation are available on the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Workaround 1

Before you upgrade to ACC 8.2.1-407 (Update 5), disable the Execution Control feature through the Policy in ePolicy Orchestrator (ePO):

Navigate to Application Control Options, Features.
Deselect Execution-Control.

Workaround 2

Disable the feature from the CLI by running the following command:

sadmin features disable Execution-Control

Workaround 3

Disable the feature by executing an SC: Run command client task from ePO:

"features disable Execution-Control"

Workaround 4

Make sure the "Execution Control" Rule group is assigned to the systems in your policy before you upgrade.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Workaround 3

Workaround 4

Affected Products

Languages:

Title

Title

Knowledge Center

Execution Control feature causes CMD or other processes to crash after upgrading to Application and Change Control 8.2.1-407 (Update 5)

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Workaround 3

Workaround 4

Affected Products

Languages:

Choose your region

Title

Title