Device Control - Rule with Invalid Data

[Mark Snell 0]

We have around 500 EndPoint Antivirus clients using Device Control, around 50 or so rules in a global policy.

Occasionally (approx. once or twice per day) we are getting error messages similar to this:

 

%ProductName%: Error

6/11/2014 7:59:16 AM - During execution of  on the computer PC1724, the following warning occurred: The imported configuration contains a rule with invalid data.

 

I cannot reproduce the problem at will (seems to be resolved by a reboot).

There seems to be no common factor other than the policy that is running (same as most other clients)

Client versions are 5.0.2214 or 5.0.2228, OS is XP or Win 7 (all with latest patches)

I am guessing this is caused by a device control rule but how can I diagnose which one?

Any ideas please?

[Marcos 5,451]

Could you please pm me the policy that is applied on these clients? If there's a problem with a Device control rule, the error should also be reported whenever the configuration xml is imported manually.

[Mark Snell 0]

Thanks for your response, Marcos.

I'm not sure how to send this info...

Do you mean export part of the policy as xml?

Pls excuse my ignorance!

[Marcos 5,451]

Are you getting this warning from same computers repeatedly even after a computer restart? The xml file with Device control rules supplied seems to be ok and it was imported alright too.

[Mark Snell 0]

For the last two weeks or so, this has been happening on one-off, random clients. Before that, the messages were for "Unknown" computers - so it's hard to say, really. However, when I investigated the logs, there didn't seem to be any pattern to it. This has been going on for at least 8 months, possible longer.

[Mark Snell 0]

This problem is still happening. How can we get it escalated please?

[Peter Randziak 1,181]

Hello Mark,

 

I would recommend you to contact your local ESET support for further investigation.

 

Please let us know how it went.