Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Preventing an MSI package from installing applications in Endpoint Application Control (TMEAC)

    • Updated:
    • 21 Jul 2016
    • Product/Version:
    • Endpoint Application Control 1.0
    • Endpoint Application Control 2.0
    • Platform:
    • Windows All
Summary

TMEAC scans the following file extensions:

  • .EXE
  • .COM
  • .CMD
  • .BIN
  • .SCR

MSI installs programs and applications but TMEAC does not block files with the .MSI extension. Blocking msiexec.exe or all MSI package from running on the system prevents the installation of important Windows applications.

Details
Public

TMEAC cannot block files with the .MSI extension because MSI cannot run by itself. MSI is a database format and is used as a parameter to the Windows Installer msiexec.exe. This means the running process is msiexec.exe and not the .MSI extension.

It is not recommended as a solution to block all MSI package from running on the system. As a workaround when stopping an MSI package from installing applications, you can extract it using 7-zip archiving utility and search for the TMEAC-supported file extensions to block.

You can either use the SHA-1 method or the Path Expressions method to properly block an MSI Package from running on the system.

Extract the MSI Package using 7-zip:

  1. Download and install 7-zip archiving utility.
  2. Right-click the MSI Package (file_to_block.msi) and select 7-zip > Open archive to browse contents.
  3. Select the .EXE, .COM, .CMD, .BIN and .SCR file extensions from the list that you need to block and extract to a temporary folder.

To make a SHA-1 hash list of the files to block, use the EAC Hash List Import Tool and read the article Creating SHA1 hash lists from a set of *.exe, *.com, *.scr, and *.bin files in Endpoint Application Control (EAC) to check hash equivalent of files to block. 

Premium
Internal
Rating:
Category:
Configure; Troubleshoot
Solution Id:
1107520
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.