CSA 4.03 and WindowsUpdate

[donlon]

Can anyone offer some advise about how to keep the Trojan Detection Rule from preventing the execution of downloaded Windows updates? On the surface the solution seems straightforward. Create an Application Class that points to *.exe with a path under **\Windows\SoftwareDistribution\**

Then go into the TD rule and include that App Class in the box that excludes an App Class from being considered as "Downloading and invoking executing files". Unfortunately, it doesn't work and no matter how I tweak, expand or modify various aspects... the rule still triggers.

Any thoughts?

[tsteger1]

Add your WindowsUpdates app class exception to the Builtin Application class : Processes executing downloaded content.

There are some other helpful posts on this subject here. Do a search for "windows updates"

Tom