Mcafee VirusScan Enterprise 7 USer Defined Access Protection Rules

[Stuart_C]

Hi there,

 

I have a bit of a problem and I'm wondering if anyone can help. I'm running VSE8.7.0i, patch 3 and the latest DAT's and Engine. I have set up a number of user defined rules in access protection policies to prevent the student in my school running files from a number of locations. I am blocking all processes the the folder/file name "h:\**\*.bat" This stops users creating batch files from their home area (see attached Image). I have an almost identical one for their destop, removable drives (E:/F:) and a couple of other places. This has been running fine for years on my XP machines however I recently purchased some Win 7 Machines and hit a problem. I noticed initally when I suddenly lost all my network drives. A little research showed this in the access protection log.

 

 
03/08/2010 14:10:43 Blocked by Access Protection rule  \ C:\Windows\system32\userinit.exe \Device\Mup\l\netlogon\lginscrpt.bat User-defined Rules:BAT From H Action blocked : Read
03/08/2010 14:12:55 Blocked by Access Protection rule  NT AUTHORITY\SYSTEM C:\Windows\system32\gpscript.exe \Device\Mup\\SysVol\Domain>\scripts\PhotoStory.bat User-defined Rules:BAT From H Action blocked : Read

 

 

Now for some reason the rule is blocking access. If I disable the rule then the next similar rule will block the file. If I disable all the rules then the batch file works. The thing is that this works on XP machines, I also cannot see how this location has violated the rule condtition. If I exclude those two processes then the flie is still blocked but the process is changed to cmd.exe which I didn't want to exclude as I want to make sure I stop the pupils running the batch files (rather than just gamling they are all run under the explorer process when in windows.

 

I also noticed that my exe blocking rule is stopping me copying files even though the source and destination locations don't violate the rule.

 

Anyone had anything similar or any ideas?