Lock Mode causing registry alerts

kcarpenterkcarpenter
in WatchGuard EPDR/EDR/EPP

When I enable Lock Mode I have a few machines that constantly receive an action block for security message. Example, SurfaceExperienceService gets blocked from what I assume is a registry entry or read. I see no way to allow this. Its got so bad that I turned off Lock mode and just enabled Hardening, which solved the problem, but then I get Detected Alerts that all my Workstations are in Hardening mode.

Comments

  • David_CarroDavid_Carro WatchGuard Representative

    Those are the Advanced Security policies. In order to check what exact policy is being triggered, we would need data from the device.
    My advice is to open a case with the support team.
    You can do so by clicking the Support Center at the top right, and register a new case for the best solution on your issue.

    Regards,

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • kcarpenterkcarpenter

    Turns out his install stopped updating. I had to uninstall and then re-install and so far the error is no longer coming up.

  • David_CarroDavid_Carro WatchGuard Representative

    Hello, @kcarpenter

    thanks for the feedback.

    have a nice day!

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

Sign In to comment.