The PUM.Optional.NoDispScrSavPage

[BrentC]

Hi,

I understand that I am getting this on all my clients because we have a group policy enforced to disable screen savers.

I tried to add it to the Ignore List, but noticed that because every profile is uniquely created within each client, this will not work.

I have read of others that have had this issue before, but could not see any solution in their posts. I would think there would be a few Corporations disabling screen savers. I can't imagine that there is not a work around or something.  Any help in this would be greatly appreciated.

Brent

[djacobson]

Hi Brent, here's what's going on. MBAM agent 1.80.x is indiscriminate when it comes to any registry modifications as a byproduct of its updated engine. It will hit on your legit GPO enforcement's. Add your GPO registry key(s) to the Policy → Ignore list, replacing the account SID‘s with the * wildcard. Note that only console and client communicator 1.6.1.2897 and above with Anti-Malware 1.80.1.1011 and above, supports this wildcard in the middle of a string, and only for registry keys.

Here’s a list I made of all the GPO changes I’ve seen get tagged as PUM: 

hku\*\software\microsoft\windows\currentversion\policies\explorer|NoStartMenuMorePrograms
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoSetFolders
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoFind
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoSMHelp
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoRun
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoViewContextMenu
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoToolbarCustomize
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoPropertiesMyComputer
hku\*\software\microsoft\windows\currentversion\policies\explorer|NoDrives
hku\*\software\microsoft\windows\currentversion\policies\explorer|ForceActiveDesktopOn
hku\*\software\microsoft\windows\currentversion\policies\system|DisableRegistryTools
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispCPL
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispBackgroundPage
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispAppearancePage
hku\*\software\microsoft\windows\currentversion\policies\system|NoDispScrSavPage
hku\*\software\policies\microsoft\internet explorer\control panel|ConnectionsTab
hku\*\software\policies\microsoft\internet explorer\control panel|HomePage
hku\*\software\policies\microsoft\windows\system|DisableCMD

 

[BrentC]

Thank you Dyllon! I have made the adjustments to my Ignore List and will no doubtingly find that it works when the clients do their scans tonight.