Lock Mode causing registry alerts

kcarpenter
kcarpenter
in WatchGuard EPDR/EDR/EPP

When I enable Lock Mode I have a few machines that constantly receive an action block for security message. Example, SurfaceExperienceService gets blocked from what I assume is a registry entry or read. I see no way to allow this. Its got so bad that I turned off Lock mode and just enabled Hardening, which solved the problem, but then I get Detected Alerts that all my Workstations are in Hardening mode.

Comments

  • David_Carro
    David_Carro

    Those are the Advanced Security policies. In order to check what exact policy is being triggered, we would need data from the device.
    My advice is to open a case with the support team.
    You can do so by clicking the Support Center at the top right, and register a new case for the best solution on your issue.

    Regards,

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • kcarpenter
    kcarpenter

    Turns out his install stopped updating. I had to uninstall and then re-install and so far the error is no longer coming up.

  • David_Carro
    David_Carro

    Hello, @kcarpenter

    thanks for the feedback.

    have a nice day!

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

Categories