Hi Tom - Yes, it is an Agent Service Control rule with description of "All applications (except virus scanners and installers), modify agent configuration".

I realize I could go ahead and exclude these apps from the rule, but am also trying to figure out why Virtual PC and Cisco's own VPN client would try to access/modify CSA processes.

Thanks.

Hi Michael,

I see several applications that try to read all files, hit the files in the CSA folder and trigger the rules.

Adobe Updater (acroaum.exe), cleanmgr.exe and findfast.exe (yes, findfast) are a few that come to mind.

I can't tell you why most of them do it.

Tom

Thanks Tom. Did you have to create any exceptions for these for the apps to work properly? We're still in test mode so trying to see what impact each of the events will have.

I either allowed it, had them uninstall it if it was unneccesary software (like findfast) or created an event supression filter.

I didn't see any impact on apps if they didn't have access.

Try protect mode on a few hosts and see what happens.

Tom