Help understanding PG actions

We need help in understanding what PG is doing as indicated by the log entries as follows. We searched through the forum and found a few related threads but these did not seem to adequately answer these questions.

c:\windows\system32\services.exe [756] Tried to modify an existing driver/service named naveng

In this case, Windows' services.exe has been called by a Norton AV admin program to change an unprotected Norton AV driver (a downloaded update). Services.exe is configured to be Allowed all priviledges.

c:\program files\common files\symantec shared\ccapp.exe [2004] Tried to modify an existing driver/service named symredrv

In this case, ccapp has been Allowed all priviledges; symredrv is an unprotected driver.

We have seen similar entries with msg [516] where a PG protected Norton program "tried to modify" another PG protected Norton program. The former has been Allowed all priviledges.

1. Does "tried" indicate that the change was attempted but failed? (We noted that the same msg is reoccuring, suggesting that a needed update is not happening.)
2. Why is PG blocking the Allowed services.exe from modifying the unprotected driver? (The General Protection Option is set to Block Driver Installs, but we understood that Allowing a program Write priviledge overrides the General setting.)
3. When two programs are both protected and Allowed all priviledges, can one still have Write access to another? In other words, does the Allow take precedence over the Block? If so, why the block in [516] above?

It appears we need a bit of education.

Thanks much in advance,

-DWG

 

Moderator, if you wish you can remove this thread.

We have egg on our face . . . think we discovered our oversight. We were only looking at the Allow and Block privileges settings, and failed to consider the program specific Options settings. This would seem to address all of our questions.

Sorry for the fire drill.

-dwg

 

Hi dwgallien,
Glad you worked it out, it can take a while to get your head round some of the interactions.

Enjoy your weekend - Pilli

 

"tried to modify" does indeed mean that it tried to modify the driver, but Process Guard blocked it from doing so.