Third-Party application failed to install when Endpoint Activity Recorder Enabled

Products

• Endpoint Security Complete

Issue/Introduction

Application failed to installed.

Environment

Windows 11 23H2

SESC 14.3 x

Cause

The purpose of  Endpoint Activity Recorder (EAR) is to monitor system activity and report it to Cloud console.

Example:

You have scenario where an installer has caused TiWorker (a Windows process) to do some additional work behind the scenes. 

EAR is configured to monitor all file system events, so it will try to get the normalized path of one of the recently created files by that process. 

TiWorker simultaneously renames the parent directory while EAR has an open handle to the file so the rename fails and the application will fail to install.

Resolution

Working as designed.

Create exceptions for these actors to avoid application conflicting with this feature and allow the application to install.

Additional Information

reference:

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud/Endpoint-Detection-and-Response/default-detection-and-response-policy-details-v134153921-d38e87208/Creating-a-recorder-policy.html

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud/Endpoint-Detection-and-Response/default-detection-and-response-policy-details-v134153921-d38e87208/EDR-policy-do-not-submit.html