When Symantec TDAD policy is applied, certain applications fail to launch with Error DotNetHookDllCs

Products

• Endpoint Security Complete
• Endpoint Threat Defense for Active Directory
• Endpoint Detection and Response

Issue/Introduction

When a Threat Defense for Active Directory policy is applied in a Symantec Endpoint Security (SES) environment, certain applications may fail to launch.  A few examples of errors are below:

 

When a Symantec Endpoint Detection and Response (EDR) policy is also applied:

Unhandled exception has occurred in <application name>. If you click Continue, the application will ignore this error and attempt to continue. If you click abort, the application will close immediately.

Could not load file or assembly 'DotNetHookDllCs, Version=1.0.0.1, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx' or one of its dependencies. Could not find or load a specific file. (Exception from HRESULT:0x80131621)

 

Without an EDR policy applied you may still notice error messages that reference:

SETDAD DotNetHookDllCs.dll

 

Environment

• Threat Defense for Active Directory
• May involve Endpoint Detection and Response

Cause

This is caused by a know limitation prior to 14.3 RU9 in how we handled certain applications.

Resolution

Possible solutions to this issue are as follows:

Upgrade the SES agent to 14.3 RU9 or later.

Upgrade any the SES agent on any device where this error is present to 14.3 RU9 or later.  If that does not resolve the issue, follow one or both of the next items below.

Create a TDAD process exception

1. Login to the SES cloud portal.
2. Edit the TDAD policy applied to the affected devices.
3. Scroll down to Exceptions by Process.
4. Click the Add button.
5. Enter the process name and save, then save the policy.

Enable Legacy .NET Obfuscation

1. Login to the SES cloud portal.
2. Edit the TDAD policy applied to the affected devices.
3. Scroll down and click the button to show Advanced settings.
4. Toggle the Enable Legacy .NET Obfuscation option.
5. Save the policy.

 

Screenshot showing the Process Exception and Enable Legacy .NET Obfuscation sections of a TDAD policy.