What security restrictions do anti-malware place on Windows processes?
Hi, I have an odd scenario where behavior is different on a computer with tighter security (e.g., endpoint protection services) . I have a .NET 4.5 app that uses Concurrent Dictionaries to track WIndows Service Status via Service Status Notification Callbacks (interop with Win32) . The logs show the call backs are working and correct and no errors or issues occur when the callback handler updates the ConcurrentDictionary. Overall logs (Win Application Log, Win System Log) show no runtime errors and endpoint monitoring system have not flagged the app in its' logs.
The problem is that downstream (thread pool) tasks don't seem to have the correct service status. Currently, this problem is isolated to a single machine; other machines don't have this issue. I assume this is a defect in my logic, but I don't understand how it could work in other operating contexts, except for one machine. The app is running under the SYSTEM account as a Windows Service. Code that updates dictionary included.
I have no idea what to look for from a security point-of-view. I am examining the process token privileges - what else could be different?
The problem is that downstream (thread pool) tasks don't seem to have the correct service status. Currently, this problem is isolated to a single machine; other machines don't have this issue. I assume this is a defect in my logic, but I don't understand how it could work in other operating contexts, except for one machine. The app is running under the SYSTEM account as a Windows Service. Code that updates dictionary included.
I have no idea what to look for from a security point-of-view. I am examining the process token privileges - what else could be different?
