Client Configuration for TACC

Prev Next

Configuration Name

Summary

Details

Customer configuration associated

Version introduced

ServiceStartFinetune

This configuration handles boot performance issues faced in few of the operating systems.

ServiceStartFinetune=7 settings can be configured on system to minimize the boot performance issues (if any). This can be configured using client task from ePO - On-prem using SC:Run command or command-line interface on standalone systems.

NA

8.3.3

UsernameRetryCountInUMode

This configuration handles boot performance issues happening due to username retrial.

User-mode lookup for the username will be retried only after a first successful resolution of the username. This ensures that Solidcore are not retrying the username unnecessarily and thereby delaying the boot. A configuration that specifies the number of retries is also added. UsernameRetryCountInUMode default value is 4 and it is configurable with client task from ePO - On-prem using SC:Run command or command-line interface in standalone systems.

CustomerConfig2 bit (8) need to be configured to revert to the original behavior where username is retried based on the retry count configured even after unsuccessful resolutions of username many times.

Example: If customerConfig2 value is 0, the CustomerConfig2 value in this case is decimal 256. This value varies based on default customerconfig2 value set. 8th bit needs to be added to default value.

8.3.3

PackageControlCmdlineFull MatchBinaries

This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package.

This configuration can be configured from ePO - On-prem as client task using SC:Run command or from command-line in standalone systems.

You must reboot the client for this configuration to take place.

NA

8.3.3

PackageControlFinetune1

This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package.

This configuration can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems.

For resolving slow performance issue during install when Trellix GTI is enabled, the configuration PackageControlFineTune1 bit introduced is 29 decimal equivalent 536870912.

NA

8.3.3

InventoryCaseSensitivity Enabled

This configuration is introduced to enable/disable case-sensitivity on inventory. After turning on case-sensitivity, cleaning inventory and re-solidification are required.

This configuration can be configured from ePO - On-prem as client task using SC:Run command or from command-line in standalone systems.

InventoryCaseSensitivity Enabled=1 for Enabling Case sensitivity for Trellix Application and Change Control.

InventoryCaseSensitivity Enabled=0 for Disabling Case Sensitivity for Trellix Application and Change Control.

NA

8.3.3

PathsWritableOnlyByUpdater

Paths added under this configuration will be write protected and only updater process can do updates to this path. This is applicable for trusted directories as well.

Refer to the secure Policy Section for default values, this can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems.

You must reboot the client for this configuration to take place.

Setting bit (14) (decimal 16384) will make the paths under PathsWritableOnlyBy Updater write-protected even if they are in trusted directory.

8.3.3

PackageControlCopyBinaries

This configuration prevents observation and event generation when a new

msi

file is created.

By default, this configuration prevents observation and event generation for three processes -

explorer.exe

,

xcopy

, and

robocopy

.

NA

8.3.5

PackageControlDisableInstallerObservations

This configuration prevents only observation generation for all processes when a new

msi

file is created.

To stop generating these observations, you need to set the value of this config as 1.

NA

8.3.5

CksumCalcMode

This configuration handles TACC checksum calculation when you create any process.

When you set CksumCalcMode to 0, it takes checksum from MPT cache and does not calculate checksum always on process creation. If set to 1, the checksum stored in inventory compares with the calculated checksum. If there is a mismatch, TACC denies the process execution.

NA

8.2.x

CustomerConfig2

This configuration helps to protect the integrity of the Solidcore directory and the Solidcore install directory in all modes except Disabled mode.

CustomerConfig2=262144 setting can be configured on the system to protect Solidcore related files to be deleted or modified in all modes except Disabled mode.

CustomerConfig2 needs to be configured to 262144 (Decimal).

8.3.6

CustomerConfig2

This configuration can be used to fetch the attributes of the files over the network path.

CustomerConfig2=524288 setting can be configured if the user needs file attribute details for the network path getting monitored.

By default, there is an improvement in performance. If the user needs file attributes over performance, they can set CustomerConfig2=524288(Decimal)

8.3.6

AvoidVolumeNameExtractionWherePossible

This configuration helps in improving solidification time

We can configure AvoidVolumeNameExtractionWherePossible to improve the solidification time by optimizing the relative path extraction of files.

AvoidVolumeNameExtractionWherePossible needs to be set to 1.

8.3.6

IgnoreContainerIO

This configuration helps in the co-existence of Docker and TACC

The IgnoreContainerIO=1 configuration allows docker services to run with TACC enabled.

IgnoreContainerIO needs to be set to 1.

8.3.6

FinetuneTieMetadata

This configuration controls the way TACC sends metadata to Trellix TIE.

When you set FinetuneTieMetadata to 0 (default), it will not send metadata. If set to 1, it will send metadata proactively or when Trellix TIE requests for the same.

NA

8.3.7

DisableCertCheck

This configuration helps to improve performance by bypassing the checks on solidified binary in execution if it is Microsoft (from system 32 or wow 64) or Trellix signed. This configuration does not apply to scripts.

When you set DisableCertCheck=1, it will not perform checks on the execution of solidified file from:

  • system 32 or wow 64 paths if it is Microsoft signed

  • any Trellix signed binary

NA

8.3.7

Configuring the CustomerConfig2 parameter

The CustomerConfig2 parameter is a bitmask used to enable specific features or resolve compatibility issues in TACC. Because it is a bitmask, each bit represents a specific function rather than an absolute value. To enable multiple features, you must perform a logical OR operation between the decimal values of the desired bits and the current configuration value.

Calculate the CustomerConfig2 value

To enable a specific bit while preserving existing configurations, follow these steps using a programmer's calculator:

  1. Identify the required bit: Locate the bit number and its decimal equivalent in the CustomerConfig2 bit details table.

  2. Determine the current value: On the endpoint, run sadmin config show CustomerConfig2 to see the current decimal value.

  3. Perform a Bitwise OR:

    • Open a calculator in Programmer mode.

    • Enter the current decimal value (for example, 3).

    • Select the OR operator.

    • Enter the decimal equivalent of the new bit (for example, 1024 for bit 10).

    • The resulting sum (for example, 1027) is the value to be applied.

Use the following decimal equivalents to enable specific functionality:

CustomerConfig2 bit details

Bit

Decimal equivalent

Summary

3

8

Skips all I/O operations (except execution) for Microsoft binaries listed in the SkipMSFTList configuration.

4

16

Skips all execution operations for Microsoft binaries listed in the SkipMSFTList configuration.

6

64

Bypasses synchronous I/O operations.

7

128

Bypasses deny-write actions if FILE_WRITE_EA is set in the CreateFile callback. This is used for compatibility with specific third-party security products.

8

256

Modifies user-mode lookup logic to prevent boot delays by retrying username resolution only after an initial success.

10

1024

Loads the driver during boot if there is a delay in loading the driver.

11

2048

Skips all package control operations for Microsoft binaries listed in the SkipMSFTList configuration.

12

4096

Prevents regedit.exe from reading TACC registry policies.

18

262144

Enables Solidcore directory protection to prevent deletion or modification of installation files.

19

524288

Allows the software to fetch file attributes over a network path.

21

2097152

Enables process passthrough for execution when added with the -p attribute.

24

16777216

Restores automatic inventory synchronization when ending Update Mode with the sadmin eu command. In TACC 8.4.2 or later, this is disabled by default to reduce CPU usage.



Modify CustomerConfig2 values

You can apply the calculated value using ePO - On-prem or the local command-line interface.

Using ePO - On-prem

  1. Select MenuClient TasksClient Task Catalog.

  2. Select Solidcore 8.x.xSC Run Commands, then click New Task.

  3. In the Command field, enter the following syntax:

    config set CustomerConfig2=<Value>

  4. Click Save.

  5. Apply the task to the target endpoints and send an Agent Wake-Up Call.

  6. Reboot the endpoint to apply the changes.

Using the Command-line Interface

  1. Open a command prompt with administrative rights.

  2. If the CLI is locked, recover it: sadmin recover.

  3. Set the new value: sadmin config set CustomerConfig2=<Value>.

  4. Verify the update: sadmin config show CustomerConfig2.

  5. Reboot the system.