ENS 10.7.0 September 2021 Update contains the fix for this issue, but you need to enable the fix using the instructions below.
Steps to enable the fix:
- Deploy or update ENS to 10.7.0 September 2021 Update.
- Check in the ePO Endpoint Deployment Kit (EEDK) package MFAPHOOK1001.zip, which is available in the "Attachment" section of this article, into the ePO main repository. The display name is: Set_MfAPHook_registry 1.0.0.0.
- Create a deployment task that installs the tool on the target client.
- Make sure that the deployment task is completed on the client. The following registry key and value is added on the client system after EEDK deployment:
- For 32-bit systems: HKLM\SOFTWARE\MCAFEE\SYSTEMCORE\HOOKCORE /v HcSvcCfg /t REG_BINARY /d 0400000000000000 /f
- For 64-bit systems: HKLM\SOFTWARE\WOW6432NODE\MCAFEE\SYSTEMCORE\HOOKCORE /v HcSvcCfg /t REG_BINARY /d 0400000000000000 /f
- When the EEDK deployment is successful, restart hookcore services or reboot the system.
Steps to revert the fix (if you see issues after applying the fix):
- Disable self-protection on the system.
- Delete the following registry keys:
- For 32-bit systems: Key HcSvcCfg under HKLM\SOFTWARE\MCAFEE\SYSTEMCORE\HOOKCORE
- For 64-bit systems: Key HcSvcCfg under HKLM\SOFTWARE\WOW6432NODE\MCAFEE\SYSTEMCORE\HOOKCORE
- Enable self-protection.
- Restart hookcore services or reboot the system.
