App Control: User specific rules not applying to MSIExec on Windows 10

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Rules applied to a specific user do not allow an MSI to run
• Block events show the user as NT Authority\System

Environment

• App Control Agent: 8.0+
• Windows 10

Cause

Due to a change in how Microsoft Windows 10 handles MSIExec, the installation is handed off from the user listed to the NT Authority\System account. User rules without this system account listed do not apply, as the execution of the file is done through this account.

Resolution

As this is now default behavior a few things can be done:

• Add the NT Authority\System account to the rule to allow the file
• Apply the rule to all users
• Approve the hash of the file, instead of using a user approval rule