Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 1 subscriber
  • Views 2199 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Falsely identified browser versions in Application control?

Mike-OB

Our application control view is providing me with some peculiar results regarding version numbers of Internet Explorer.

Currently our SEC is at V5.0.0.8 and all endpoints are at 10.0.11.

What I am seeing is a number of endpoints displaying their browser at IE6 and IE7 but when I have checked them, they are running IE8- Registry entries display the same.

I this a known error, or is it likely there is some residue of IE6 / 7 hanging around from a migration?

It's not causing me massive pain, but does concern me that there may be other elements displaying incorrectly.

Any thoughts / help would be much appreciated

:44481


This thread was automatically locked due to age.
Parents
  • 0

    Hello Mike-OB,

    is it likely there is some residue

    this is the case, there are leftovers in several places. The Computer details in SEC will show the user context and the endpoint's SAV.txt the item (e.g. file) causing the detection. For a scheduled or on-demand scan (when detection is enabled) this is to be expected but I can't say why Windows obviously accesses these locations during "normal operation".

    If you use Application Control to block unwanted versions it should work as intended (but the event doesn't signify an actual attempt to run IE). If you use Detect but allow to run it's not really meaningful though.

    Christian

    :44485
Reply
  • 0

    Hello Mike-OB,

    is it likely there is some residue

    this is the case, there are leftovers in several places. The Computer details in SEC will show the user context and the endpoint's SAV.txt the item (e.g. file) causing the detection. For a scheduled or on-demand scan (when detection is enabled) this is to be expected but I can't say why Windows obviously accesses these locations during "normal operation".

    If you use Application Control to block unwanted versions it should work as intended (but the event doesn't signify an actual attempt to run IE). If you use Detect but allow to run it's not really meaningful though.

    Christian

    :44485
Children
No Data
Cookie Information Banner