Windows Action Center prompts "Do you want to run this app?" for WSCSavNotifier.exe

Products

• Endpoint Protection

Issue/Introduction

During the Symantec Endpoint Protection (SEP) client installation, or when clicking a prompt to update the SEP client, users receive a prompt from the Windows Action Center stating

"Do you want to run this app? You should only run apps that come from publishers you trust"

Publisher: Symantec Corporation
Program: Symantec Corporation
C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\\Bin\WSCSavNotifier.exe

Cause

The SEP client registers WSCSavNotifier.exe as a callback process with Windows Action Center. This allows the SEP client to update the Action Center with status information about the SEP client. It also allows the Windows Action Center to call the SEP client through the callback process to perform certain actions, including enabling/disabling the SEP client, and launching LiveUpdate.

When users take an action in Windows Action Center that launches a third party application, Action Center prompts the user to confirm they trust the application. This happens regardless of the status of the digital certificate(s) associated with the application.

Resolution

WSCSavNotifier.exe is digitally signed by Symantec and is safe to run. If you ignore or cancel the prompt, the SEP client will still attempt to automatically update its content in the background.

Click "Yes, I trust the publisher and want to run this app" to allow the SEP client to perform its remediation action

Note: If you do not wish to be prompted to allow WSCSavNotifier.exe to run in the future, check "Don't show me this again".