Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

AutoCad LT and CSA version 6.0.0.201

I am a newbie to CSA and we are running version 6 and I can't get AutoCAD LT to run on a machine running CSA. When I uninstall all is well. I am sure I am missing something and was hoping someone could help me on this one.

Thanks,

Dan

1 ACCEPTED SOLUTION

Accepted Solutions
Blue

Re: AutoCad LT and CSA version 6.0.0.201

That is typically the case with these problematic apps. Disabling csauser.dll will make the problem go away but you lose much functionality.

Mine worked with this rule:

When try to run it will .

That should fix it.

Is that how your rule is configured?

Tom

26 REPLIES
New Member

Re: AutoCad LT and CSA version 6.0.0.201

The first thing I would do, is turn on the verbose logging and put the agent in "Audit" mode. This way you can see what CSA could possibly be blocking. From there you could add your exceptions that allow AutoCAD LT to run.

New Member

Re: AutoCad LT and CSA version 6.0.0.201

I turned on Verbose logging and ran AutoCad and nothing showed up in the logs.

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Put the group the host is in, in Audit mode. This will show all events firing.

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Done and still nothing.

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Are you seeing any events whatsoever? Or just not AutoCAD related?

New Member

Re: AutoCad LT and CSA version 6.0.0.201

I do see other events. Just nothing from AutoCAD.

Blue

Re: AutoCad LT and CSA version 6.0.0.201

You may need to create a rule that adds AutoCAD LT to the DAC <*Processes requiring Kernel Only Protection> to allow it to function properly.

It is documented here and though it is for v 4.5, it should work the same for v6.

http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_configuration_example09186a00805f0c18.shtml

Tom

Silver

Re: AutoCad LT and CSA version 6.0.0.201

Tom's answer is spot-on. a "5" from NYC.

Blue

Re: AutoCad LT and CSA version 6.0.0.201

Thanks Paul, I hope it works!

Let us know how it goes Dan.

Tom

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Sorry Guys. I am just getting back to this issue. I will try what you recommend and let you know.

Thanks,

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

I did what you recommended and still nothing. Must be something other than the aclt.exe that is shutting it down.

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Will I uninstalled CSA from a Client having issues with AcadLT and found only 2 processes happen when running AcadLT aclt.exe and assist.exe. I am going to try what you recommended with regard to an excultion of the assist.exe and see what happens.

Thanks,

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Will I uninstalled CSA from a Client having issues with AcadLT and found only 2 processes happen when running AcadLT aclt.exe and assist.exe. I am going to try what you recommended with regard to an excultion of the assist.exe and see what happens.

Thanks,

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

I tried this with both files I found starting and still the application shuts down.

Thanks for you help. I am going to open a case with TAC.

New Member

Re: AutoCad LT and CSA version 6.0.0.201

It turns out it is the csauser shim causing the problem. I will post the final fix once I have it.

Blue

Re: AutoCad LT and CSA version 6.0.0.201

That is typically the case with these problematic apps. Disabling csauser.dll will make the problem go away but you lose much functionality.

Mine worked with this rule:

When try to run it will .

That should fix it.

Is that how your rule is configured?

Tom

New Member

Re: AutoCad LT and CSA version 6.0.0.201

TAC had me change the hosts csauser shim reg key to csauser.dll to csauser.dll.org. They claimed it will not hurt anything doing this on the hosts. It concerns me, but I am not sure what else to do.

Thanks,

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

The Fix is a reg hack to disable the csauser shim. according to Cisco this is an okay work around, but it does fix the problem.

Blue

Re: AutoCad LT and CSA version 6.0.0.201

We had to do that for another mysterious problem which they eventually released a hotfix for.

What is 'assist.exe' and where does it reside?

Tom

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Assist.exe is what starts with AutoCAD LT. It is just like a help screen.

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Hi Dan,

Have you configured kernel-only protection for this application? When you disable csauser it disables user space hooking for all applications on the endpoint. This is a good test to see if that is your problem (which it sounds like is the issue.) To get more granular and only disable for a single application you can use this procedure:

http://supportwiki.cisco.com/ViewWiki/index.php/Configuring_Kernel-only_Protection_for_an_Application_in_CSA_6.0

Hope that helps!

Thanks,

Josh

Blue

Re: AutoCad LT and CSA version 6.0.0.201

Hi Josh, I asked him to do that and he said it didn't work for either process.

Unsure what his configuration was.

Tom

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Hi Tom - Saw your previous post so thanks for the heads up as I didn't see that before.

Dan - It may be an issue of the actual processes you are targeting. Instead of narrowing down to these 2 .exes start by creating an app class for all .exes in the AutoCad directory. Then you can narrow it down more from there (assuming that works.) Also, make sure you reboot the PC in case some AutoCad processes start at boot time.

A little background (for those that are interested.) The reason AutoCad LT has an issue is it's licensing protection mechanism. AutoCad sees CSA hooking the user space memory and thinks that you are trying to evade their licensing. Therefore the application shuts down, or otherwise doesn't quite work properly.

Let us know if the larger App Class works for you.

Thanks,

Josh

New Member

Re: AutoCad LT and CSA version 6.0.0.201

I will try this and let you know.

Thanks for all the input.

Dan

New Member

Re: AutoCad LT and CSA version 6.0.0.201

In CSA 4, I needed to tune for AutoCAD LT because it was causing a buffer overflow. It did not create any events, I had to write a manual rule for the main executable. I think the rule migrated to 6 without any chanes.

New Member

Re: AutoCad LT and CSA version 6.0.0.201

Another thought is that you have a buffer overrun, and need to create an exception even though an event is not logged. I had to "blind tune" several apps in 4.0 due to this behaviour.

330
Views
15
Helpful
26
Replies
CreatePlease to create content