SEP 12.1 Tamper Protection Scan with CCMEXEC.EXE (SCCM 2012)

[D-M]

Hi Everyone

 

Our SCCM client has been upgraded from SCCM 2007 to 2012.

Now, when the PC is rebooted, we are getting this in eventlogs on all the workstations.

------------------

Scan type: Tamper Protection Scan

Event: Tamper Protection Detection

Security risk detected: C:\WINDOWS\CCM\CCMEXEC.EXE

File: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\DWHWizrd.exe

Location: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin

Computer: computername

User: SYSTEM

Action taken: Leave Alone

Date found: Thursday, 22 October 2015 7:17:47 AM

--------------------

 

Sometimes, this comes up with different filename:

File: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.5337.5000.105\Bin\ccSvcHst.exe

 

If i restart the SCCM client service (ccmexec) this event gets logged straight away.

 

Does anyone know why this is happening? False positive?

Could CCMEXEC be doing its own kind of scan when starting up, that is upsetting SEP?

Any workaround?

 

Thanks,

DM

[PraveenAyappan]

Have you tired to add a Tamper protection exception and set the action to ignore ?

[GeoGeo]

If the location remains the same all the time add it in to the tamper protection exceptions policy should resolve the issue. 

[ℬrίαη]

Add it as an exception

What should I do when I get a Tamper Protection Alert?

[D-M]

Thanks all.

I have also been told that 12.1.6 should fix this issue.

Will add it as an exception and trial 12.1.6 client as well.

Cheers. DM.