MCAFEE denied installing on client with %path% pointing to UNC share

by butsch 17. September 2015 14:42

Check your %path% variable if some software made UNC path in it. While this was heavy used on Windows XP under our standard Windows 7 client system this looks rather small.

Three samples on Windows 7 64 But with Domain user. None of them point to other than c: local drive.


Installing VirusScan to an environment that's required to place UNC shares into the PATH environment variable (%path%) is not advisable. The SYSTEM account, and all processes or services running as SYSTEM will be affected and potentially negatively as it requires Windows to check remote locations for needed files. In our experience this has caused our real-time scanner, the core part of AV protection, to fail to initialize properly on startup. Consequently, we modified our installer to check for this condition and abort installing to such an environment, to reinforce how it's not best practice or to at least bring attention to it. That install check can be overridden, as explained in article KB71200 (, but should only be done once it has been confirmed the product still functions in that environment. If there are issues, they cannot be solved by Intel Security except to advise removal of the UNC paths from the PATH environment variable.

If you have third party software that requires a UNC share in the PATH environment variable, contact your vendor for options. Any portable executable code required for that third party application to run on the local client should also be local (not have need for a UNC share). This also ensures a safer computing environment because those local files can then be scanned by the local scanner. Remote files are not scanned when accessed from a client running VirusScan Enterprise unless Network Drive Scanning is enabled, which means your third party application may be running code in memory that has not been scanned.


For information about Network Drive Scanning, see the VSE Product Guide (, and Best Practices (




Comments are closed

Werbung von Drittfirmen (Nicht Butsch Informatik):

Werbung von Drittfirmen via Google Adsense: