App Vol 2.13.1 / Chrome appstack / SEP 14 running on master = Chrome fails upon launch

[Shappelle]

Hi:

Set up App Vol 2.13.1 and was building new appstacks for Win10 when I noticed that Chrome opens but fails (little frowny fav icon). I can't navigate to any sites.

If I uninstall SEP from the master, Chrome as an appstack works fine.

In the past, the Generic Exploit Mitigation tool caused Chrome to fail to even open, but we updated the policy to disable GEM. That seemed to work with App Vol 2.12.1 and Win7, where we were seeing issues (no issues in Win10 at that time).

Now, with App Vol 2.13.1, I am finding that, even with GEM disabled, Chrome will open, but nothing works.

Has anyone experienced anything like this?

[Shappelle]

My workaround was to have a new SEP package built that is AV only. I also read a policy update to set SysPlant registry DWORD 'start' to a value of 4 may also help, but I didn't bother. Looks like Chrome and SEP have had issues for years, off and on.

[jahegyi]

While I did not have this issue on earlier versions, I am now experiencing this with 2.13.1. Same as you, disabling GEMs doesn't work.

The removal of SEP fixes the issue. We are in a bind, however. Info sec with not allow the registry change and our AV team will not build a package without GEMs.

[rogal7]

I had the same issue and workaround was, to remove one entry in registry in Parent machine:

1) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\svdriver\Parameters

2) There is Multi-String value there called "HookInjectionWhitelist"

3) Remove *chrome.exe||* from list

Shutdown Parent Machine, create snapshot, recompose/push new image.

[fdrietatns]

Bump,

This is a solid workaround but it shouldn't be an issue to begin with.