Version
7.x
Issue
Tamper protect block regarding SCEP process
Symptoms
Receiving a tamper protect block event for process msmpeng.exe
Cause
Msmpeng.exe is scanning Bit9 files
Solution
On SCEP, go to Policy then click on Exclusion Settings and set the exclusion for Files and Folders:
C:\Program Files\Bit9\*
C:\Program Files (x86)\Bit9\*
C:\ProgramData\Bit9\*
C:\Documents and Settings\All Users\Application Data\Bit9\*
Please adjust the path(s) above if the Bit9 agent was installed on non-default location.
Add this custom rule on the Bit9 console (Rules > Software Rules > Custom):
Type: Performance Optimization
Path: <CommonAppData>\Microsoft\Microsoft Antimalware\*
Process: *msmpeng.exe
#AppControl