App Control Agent: Blocking of C2R64.dll and C2R32.dll cause O365 updates to fail

[#1]

Environment

• App Control Agent : 8.5.0 and below
• Microsoft Office 365 : All versions

Symptoms

• Unable to run O365 updates
• App Control agent blocking C2R64.dll and C2R32.dll files during O365 updates
• App Control agent unable to hash O365 binaries
• Blocked events logged with description "File 'c:\program files\common files\microsoft shared\clicktorun\updates\16.0.12527.21416\c2r64.dll' [  ] was blocked because it was unapproved"

Cause

Parity driver is unable to hash c2r64.dll due to a non-existing path error encountered while resolving the file path.
 

Resolution

• This issue is fixed in upcoming App Control Windows Agent 8.6.0 via EP-11546
• Please use the following workaround for this issue:

1. Go to https://<CB Protection server>/agent_config.php
2. Add Agent Config
3. Set properties as follows:

Property Name: Allow Inaccessible Files

Host ID: 0
Value: allow_inaccessible_files=2
Status: Enabled

4. Save the changes
5. Test the issue