Configuration Name | Summary | Details | Customer configuration associated | Version introduced |
|---|---|---|---|---|
| This configuration handles boot performance issues faced in few of the operating systems. | ServiceStartFinetune=7 settings can be configured on system to minimize the boot performance issues (if any). This can be configured using client task from ePO - On-prem using SC:Run command or command-line interface on standalone systems. | NA | 8.3.3 |
| This configuration handles boot performance issues happening due to username retrial. | User-mode lookup for the username will be retried only after a first successful resolution of the username. This ensures that Solidcore are not retrying the username unnecessarily and thereby delaying the boot. A configuration that specifies the number of retries is also added. UsernameRetryCountInUMode default value is 4 and it is configurable with client task from ePO - On-prem using SC:Run command or command-line interface in standalone systems. | CustomerConfig2 bit (8) need to be configured to revert to the original behavior where username is retried based on the retry count configured even after unsuccessful resolutions of username many times. Example: If customerConfig2 value is 0, the CustomerConfig2 value in this case is decimal 256. This value varies based on default customerconfig2 value set. 8th bit needs to be added to default value. | 8.3.3 |
| This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package. | This configuration can be configured from ePO - On-prem as client task using SC:Run command or from command-line in standalone systems. You must reboot the client for this configuration to take place. | NA | 8.3.3 |
| This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package. | This configuration can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems. For resolving slow performance issue during install when Trellix GTI is enabled, the configuration PackageControlFineTune1 bit introduced is 29 decimal equivalent 536870912. | NA | 8.3.3 |
| This configuration is introduced to enable/disable case-sensitivity on inventory. After turning on case-sensitivity, cleaning inventory and re-solidification are required. | This configuration can be configured from ePO - On-prem as client task using SC:Run command or from command-line in standalone systems. InventoryCaseSensitivity Enabled=1 for Enabling Case sensitivity for Trellix Application and Change Control. InventoryCaseSensitivity Enabled=0 for Disabling Case Sensitivity for Trellix Application and Change Control. | NA | 8.3.3 |
| Paths added under this configuration will be write protected and only updater process can do updates to this path. This is applicable for trusted directories as well. | Refer to the secure Policy Section for default values, this can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems. You must reboot the client for this configuration to take place. | Setting bit (14) (decimal 16384) will make the paths under PathsWritableOnlyBy Updater write-protected even if they are in trusted directory. | 8.3.3 |
| This configuration prevents observation and event generation when a new msi file is created. | By default, this configuration prevents observation and event generation for three processes - explorer.exe , xcopy , and robocopy . | NA | 8.3.5 |
| This configuration prevents only observation generation for all processes when a new msi file is created. | To stop generating these observations, you need to set the value of this config as | NA | 8.3.5 |
| This configuration handles TACC checksum calculation when you create any process. | When you set CksumCalcMode to 0, it takes checksum from MPT cache and does not calculate checksum always on process creation. If set to 1, the checksum stored in inventory compares with the calculated checksum. If there is a mismatch, TACC denies the process execution. | NA | 8.2.x |
| This configuration helps to protect the integrity of the Solidcore directory and the Solidcore install directory in all modes except Disabled mode. | CustomerConfig2=262144 setting can be configured on the system to protect Solidcore related files to be deleted or modified in all modes except Disabled mode. | CustomerConfig2 needs to be configured to 262144 (Decimal). | 8.3.6 |
| This configuration can be used to fetch the attributes of the files over the network path. | CustomerConfig2=524288 setting can be configured if the user needs file attribute details for the network path getting monitored. | By default, there is an improvement in performance. If the user needs file attributes over performance, they can set CustomerConfig2=524288(Decimal) | 8.3.6 |
| This configuration helps in improving solidification time | We can configure AvoidVolumeNameExtractionWherePossible to improve the solidification time by optimizing the relative path extraction of files. | AvoidVolumeNameExtractionWherePossible needs to be set to 1. | 8.3.6 |
| This configuration helps in the co-existence of Docker and TACC | The IgnoreContainerIO=1 configuration allows docker services to run with TACC enabled. | IgnoreContainerIO needs to be set to 1. | 8.3.6 |
| This configuration controls the way TACC sends metadata to Trellix TIE. | When you set FinetuneTieMetadata to 0 (default), it will not send metadata. If set to 1, it will send metadata proactively or when Trellix TIE requests for the same. | NA | 8.3.7 |
| This configuration helps to improve performance by bypassing the checks on solidified binary in execution if it is Microsoft (from system 32 or wow 64) or Trellix signed. This configuration does not apply to scripts. | When you set DisableCertCheck=1, it will not perform checks on the execution of solidified file from:
| NA | 8.3.7 |
Configuring the CustomerConfig2 parameter
The CustomerConfig2 parameter is a bitmask used to enable specific features or resolve compatibility issues in TACC. Because it is a bitmask, each bit represents a specific function rather than an absolute value. To enable multiple features, you must perform a logical OR operation between the decimal values of the desired bits and the current configuration value.
Calculate the CustomerConfig2 value
To enable a specific bit while preserving existing configurations, follow these steps using a programmer's calculator:
Identify the required bit: Locate the bit number and its decimal equivalent in the CustomerConfig2 bit details table.
Determine the current value: On the endpoint, run sadmin config show CustomerConfig2 to see the current decimal value.
Perform a Bitwise OR:
Open a calculator in Programmer mode.
Enter the current decimal value (for example, 3).
Select the OR operator.
Enter the decimal equivalent of the new bit (for example, 1024 for bit 10).
The resulting sum (for example, 1027) is the value to be applied.
Use the following decimal equivalents to enable specific functionality:
Bit | Decimal equivalent | Summary |
|---|---|---|
3 | 8 | Skips all I/O operations (except execution) for Microsoft binaries listed in the |
4 | 16 | Skips all execution operations for Microsoft binaries listed in the |
6 | 64 | Bypasses synchronous I/O operations. |
7 | 128 | Bypasses deny-write actions if FILE_WRITE_EA is set in the CreateFile callback. This is used for compatibility with specific third-party security products. |
8 | 256 | Modifies user-mode lookup logic to prevent boot delays by retrying username resolution only after an initial success. |
10 | 1024 | Loads the driver during boot if there is a delay in loading the driver. |
11 | 2048 | Skips all package control operations for Microsoft binaries listed in the |
12 | 4096 | Prevents |
18 | 262144 | Enables Solidcore directory protection to prevent deletion or modification of installation files. |
19 | 524288 | Allows the software to fetch file attributes over a network path. |
21 | 2097152 | Enables process passthrough for execution when added with the |
24 | 16777216 | Restores automatic inventory synchronization when ending Update Mode with the sadmin eu command. In TACC 8.4.2 or later, this is disabled by default to reduce CPU usage. |
Modify CustomerConfig2 values
You can apply the calculated value using ePO - On-prem or the local command-line interface.
Using ePO - On-prem
Select Menu → Client Tasks → Client Task Catalog.
Select Solidcore 8.x.x → SC Run Commands, then click New Task.
In the Command field, enter the following syntax:
config set CustomerConfig2=<Value>Click Save.
Apply the task to the target endpoints and send an Agent Wake-Up Call.
Reboot the endpoint to apply the changes.
Using the Command-line Interface
Open a command prompt with administrative rights.
If the CLI is locked, recover it:
sadmin recover.Set the new value:
sadmin config set CustomerConfig2=<Value>.Verify the update:
sadmin config show CustomerConfig2.Reboot the system.