Unable to set up deny ACLs on C:\ when a product using SysCore is installed

Technical Articles ID: KB95918
Last Modified: 2022-08-16 04:42:05 Etc/GMT

Environment

Application and Change Control (ACC) 8.x, 6.x
Endpoint Security (ENS) Threat Prevention 10.x

Problem

After installing a product that uses SysCore (for example, ENS or ACC), you're unable to configure deny ACLs on the NTFS file system permissions on the C:\ drive. This action is blocked due to SysCore self-protection rules.

Cause

Set-security operations on parent folders as ACLs can be used to block access to the protected folders. So, the SysCore Arbitrary Access Control (AAC) rules treat this action as a delete. As a result, set-security on the C:\ drive is blocked if there's at least one rule in place that blocks deletion of a subdirectory under C:\. By default, SysCore self-protection has these rules.

Workaround

For ENS:

ENS allows you to disable self-protection via policy, and the ability to configure Global AAC Exclusions. Technical Support doesn't recommend using Global AAC Exclusions unless absolutely needed, due to the security implications of bypassing AAC entirely.

For ACC:

ACC doesn't provide a way to enable or disable the SysCore self-protection in the same way ENS does. Once installed on a system, even in a Disabled state, SysCore self-protection remains active.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Unable to set up deny ACLs on C:\ when a product using SysCore is installed

Environment

Problem

Cause

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Unable to set up deny ACLs on C:\ when a product using SysCore is installed

Environment

Problem

Cause

Workaround

Affected Products

Languages:

Choose your region

Title

Title