Configuration Name | Summary | Details | Customer configuration associated | Version introduced |
|---|---|---|---|---|
| This configuration handles boot performance issues faced in few of the operating systems. | ServiceStartFinetune=7 settings can be configured on system to minimize the boot performance issues (if any). This can be configured using client task from ePO - On-prem using SC:Run command or command-line interface on standalone systems. | NA | 8.3.3 |
| This configuration handles boot performance issues happening due to username retrial. | User-mode lookup for the username will be retried only after a first successful resolution of the username. This ensures that Solidcore are not retrying the username unnecessarily and thereby delaying the boot. A configuration that specifies the number of retries is also added. UsernameRetryCountInUMode default value is 4 and it is configurable with client task from ePO - On-prem using SC:Run command or command-line interface in standalone systems. | CustomerConfig2 bit (8) need to be configured to revert to the original behavior where username is retried based on the retry count configured even after unsuccessful resolutions of username many times. Example: If customerConfig2 value is 0, the CustomerConfig2 value in this case is decimal 256. This value varies based on default customerconfig2 value set. 8th bit needs to be added to default value. | 8.3.3 |
| This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package. | This configuration can be configured from ePO - On-prem as client task using SC:Run command or from command-line in standalone systems. You must reboot the client for this configuration to take place. | NA | 8.3.3 |
| This configuration is introduced as a generic option to fine-tune package control and resolve performance issues related to installation package. | This configuration can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems. For resolving slow performance issue during install when Trellix GTI is enabled, the configuration PackageControlFineTune1 bit introduced is 29 decimal equivalent 536870912. | NA | 8.3.3 |
| Paths added under this configuration will be write protected and only updater process can do updates to this path. This is applicable for trusted directories as well. | Refer to the secure Policy Section for default values, this can be configured from ePO - On-prem as client task using SC:Run Command or from command-line interface in standalone systems. You must reboot the client for this configuration to take place. | Setting bit (14) (decimal 16384) will make the paths under PathsWritableOnlyBy Updater write-protected even if they are in trusted directory. | 8.3.3 |
| This configuration prevents observation and event generation when a new msi file is created. | By default, this configuration prevents observation and event generation for three processes - explorer.exe, xcopy, and robocopy. | NA | 8.3.5 |
| This configuration prevents only observation generation for all processes when a new msi file is created. | To stop generating these observations, you need to set the value of this config as | NA | 8.3.5 |
| This configuration handles TACC checksum calculation when you create any process. | The default set value is 0. When you set CksumCalcMode to 0, it takes checksum from MPT cache and does not calculate checksum always on process creation. If set to 1, the checksum stored in inventory compares with the calculated checksum. If there is a mismatch, TACC denies the process execution. | NA | 8.2.x |
| This configuration helps to protect the integrity of the Solidcore directory and the Solidcore install directory in all modes except Disabled mode. | CustomerConfig2=262144 setting can be configured on the system to protect Solidcore related files to be deleted or modified in all modes except Disabled mode. | CustomerConfig2 needs to be configured to 262144 (Decimal). | 8.3.6 |
| This configuration can be used to fetch the attributes of the files over the network path. | CustomerConfig2=524288 setting can be configured if the user needs file attribute details for the network path getting monitored. | By default, there is an improvement in performance. If the user needs file attributes over performance, they can set CustomerConfig2=524288(Decimal) | 8.3.6 |
| This configuration helps in improving solidification time | We can configure AvoidVolumeNameExtractionWherePossible to improve the solidification time by optimizing the relative path extraction of files. | AvoidVolumeNameExtractionWherePossible needs to be set to 1. | 8.3.6 |
| This configuration helps in the co-existence of Docker and TACC | The IgnoreContainerIO=1 configuration allows docker services to run with TACC enabled. | IgnoreContainerIO needs to be set to 1. | 8.3.6 |
| This configuration controls the way TACC sends metadata to Trellix TIE. | When you set FinetuneTieMetadata to 0 (default), it will not send metadata. If set to 1, it will send metadata proactively or when Trellix TIE requests for the same. | NA | 8.3.7 |
| This configuration helps to improve boot time performance by bypassing the checks on solidified binary in execution if it is Microsoft (from system 32 or wow 64) or Trellix signed. This configuration does not apply to scripts. | The default set value is 0. When you set DisableCertCheck=1, it will not perform checks on the execution of solidified file from:
| NA | 8.3.7 |
| This configuration allows third-party applications to run in a sandbox environment. | The default set value is 1. This configuration has three values: 0, 1, and 2. When set to 0, it deactivates the MPCompact feature. When set to 1, it applies the MPCompact feature to applications with the 'h' attribute set. When set to 2, it applies the MPCompact feature to all applications except those with the 'j' attribute set. The "sadmin attr" command is used to include or exclude a binary from MPCompat enforcement. Two new flags, "-h" and "-j," have been introduced. The "-h" flag adds a binary to the MPCompat include list, while the "-j" flag adds it to the MPCompat exclude list. | NA | 7.0.x |
| This configuration determines whether to call LoadLibraryW from kernel32.dll or LdrLoadDll from ntdll.dll. | The default set value is 0. When the configuration is 0, we call LoadLibraryW from kernel32.dll and do not inject any code in target process. When the config is 1, we call LdrLoadDll in ntdll.dll and inject our code in target process. | NA | x.x.x |
| This configuration allows or blocks inventory backup on managed clients. | The default set value is 0. When set to 1, this configuration initiates the usermode inventory backup. | NA | x.x.x |
| This configuration is used to back up the inventory before restarting the client. | The default set value is 0. When set to 1, this configuration backs up the inventory before restarting the client. | NA | x.x.x |
| This configuration is used for optimizing the solidification thread (excluding Disable mode) | The default set value is 0. A stack is called every time a file is created/executed. We can prevent this by checking if the current process is scsrvc.exe. This is done by disabling an optimization added for the initial solidification (whitelist creation) by setting this configuration to 0. | NA | x.x.x |
| This configuration enables the checksum calculation in parallel thread. | The default set value is 0. When set to 1, this enables the feature to calculate checksum in parallel. | NA | x.x.x |
| This configuration allows file execution based on a combination of certificate and updater name rule. | The default set value is 0. When set to 1, this will enable the feature. | NA | x.x.x |
| This configuration disables volume mount/unmount reference counting. | The default set value is 0. When set to 1, this will disable the ref counting of volume reference. | NA | x.x.x |
| This configuration disables code unloads in inventory memory for volumes that are not present in the system. It is activated after the inventory merge. | The default set value is 0. When set to 1, this will disable the feature. | NA | 8.3.6 |
| This configuration is used to enable or disable case sensitivity on inventory. After enabling case sensitivity, cleaning inventory and re-solidification are needed. | Enables or disables inventory case sensitivity. To change the case-sensitivity setting, clean the inventory and re-solidify it after updating the configuration. Supported values:
| NA | 8.3.3 |
| This configuration is used to disable the Reputation cache operation mode in the TIE server topology. | The default set value is 0. When set to 1, this will disable the reputation cache. | NA | x.x.x |
| This configuration will skip the validation of file paths longer than QFILE_MAX_PATH characters, which causes file creation failures on some machines. | The default set value is 1. When set to 0, the file length validation will be checked. | NA | 7.0.x |
| This configuration is used to enable or disable the Trusted Local Group feature. | The default set value is 1. When set to 0, this feature will be disabled. | NA | 8.3.0 |
| This configuration introduces additional self-protection mechanisms for specific TACC files, including evt_cache, inventory, TACC log files, and the TACC service. | The default 'isAACAplied' value is 14. Each protection type has an associated value:
To enable log protection, set the value to 15. To disable a specific protection, subtract its corresponding value from isAACAplied. Example: The default value is 14 (2+4+8) = (Inventory + event_cache + TACC_service). To disable event cache protection, set the value to 10 (14 - 4). | NA | 8.4.3 |
Configuring the CustomerConfig2 parameter
The CustomerConfig2 parameter is a bitmask used to enable specific features or resolve compatibility issues in TACC. Because it is a bitmask, each bit represents a specific function rather than an absolute value. To enable multiple features, you must perform a logical OR operation between the decimal values of the desired bits and the current configuration value.
Calculate the CustomerConfig2 value
To enable a specific bit while preserving existing configurations, follow these steps using a programmer's calculator:
Identify the required bit: Locate the bit number and its decimal equivalent in the CustomerConfig2 bit details table.
Determine the current value: On the endpoint, run sadmin config show CustomerConfig2 to see the current decimal value.
Perform a Bitwise OR:
Open a calculator in Programmer mode.
Enter the current decimal value (for example, 3).
Select the OR operator.
Enter the decimal equivalent of the new bit (for example, 1024 for bit 10).
The resulting sum (for example, 1027) is the value to be applied.
Use the following decimal equivalents to enable specific functionality:
Bit | Decimal equivalent | Summary |
|---|---|---|
3 | 8 | Skips all I/O operations (except execution) for Microsoft binaries listed in the |
4 | 16 | Skips all execution operations for Microsoft binaries listed in the |
6 | 64 | Bypasses synchronous I/O operations. |
7 | 128 | Bypasses deny-write actions if FILE_WRITE_EA is set in the CreateFile callback. This is used for compatibility with specific third-party security products. |
8 | 256 | Modifies user-mode lookup logic to prevent boot delays by retrying username resolution only after an initial success. |
10 | 1024 | Loads the driver during boot if there is a delay in loading the driver. |
11 | 2048 | Skips all package control operations for Microsoft binaries listed in the |
12 | 4096 | Prevents |
18 | 262144 | Enables Solidcore directory protection to prevent deletion or modification of installation files. |
19 | 524288 | Allows the software to fetch file attributes over a network path. |
21 | 2097152 | Enables process passthrough for execution when added with the |
24 | 16777216 | Restores automatic inventory synchronization when ending Update Mode with the sadmin eu command. In TACC 8.4.2 or later, this is disabled by default to reduce CPU usage. |
Modify CustomerConfig2 values
You can apply the calculated value using ePO - On-prem or the local command-line interface.
Using ePO - On-prem
Select Menu → Client Tasks → Client Task Catalog.
Select Solidcore 8.x.x → SC Run Commands, then click New Task.
In the Command field, enter the following syntax:
config set CustomerConfig2=<Value>Click Save.
Apply the task to the target endpoints and send an Agent Wake-Up Call.
Reboot the endpoint to apply the changes.
Using the Command-line Interface
Open a command prompt with administrative rights.
If the CLI is locked, recover it:
sadmin recover.Set the new value:
sadmin config set CustomerConfig2=<Value>.Verify the update:
sadmin config show CustomerConfig2.Reboot the system.