Exploit Guard blocking Chrome making calls Win32k.sys





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







0















I am in the process of implementing Exploit Guard in our W10 corporate image.
I configured it using the GPO "Use a common set of exploit protection settings" that makes use of a XML file. Initially, Chrome.exe was not included in the XML file.



I realized that when I opened Chrome, an event ID 10 appeared in

Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode




Process 'DeviceHarddiskVolume2Program Files
(x86)GoogleChromeApplicationchrome.exe' (PID 9740) was blocked
from making system calls to Win32k.sys.




I even explicitly included chrome.exe as an exception in the Program Setting list, forcing OFF in the setting "Disable Win32 system calls". To do that, I just added this code to the XML file:



<AppConfig Executable="chrome.exe">     
<SystemCalls> DisableWin32kSystemCalls="false"/>
</AppConfig>


But nothing changes, and the same event ID appears. One interesting thing is that Chrome seems to work fine, with no error windows or crashes.



Any idea how to solve this situation?










share|improve this question

























  • Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

    – harrymc
    Feb 11 at 10:14











  • I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

    – YaKs
    Feb 11 at 10:53


















0















I am in the process of implementing Exploit Guard in our W10 corporate image.
I configured it using the GPO "Use a common set of exploit protection settings" that makes use of a XML file. Initially, Chrome.exe was not included in the XML file.



I realized that when I opened Chrome, an event ID 10 appeared in

Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode




Process 'DeviceHarddiskVolume2Program Files
(x86)GoogleChromeApplicationchrome.exe' (PID 9740) was blocked
from making system calls to Win32k.sys.




I even explicitly included chrome.exe as an exception in the Program Setting list, forcing OFF in the setting "Disable Win32 system calls". To do that, I just added this code to the XML file:



<AppConfig Executable="chrome.exe">     
<SystemCalls> DisableWin32kSystemCalls="false"/>
</AppConfig>


But nothing changes, and the same event ID appears. One interesting thing is that Chrome seems to work fine, with no error windows or crashes.



Any idea how to solve this situation?










share|improve this question

























  • Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

    – harrymc
    Feb 11 at 10:14











  • I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

    – YaKs
    Feb 11 at 10:53














0












0








0








I am in the process of implementing Exploit Guard in our W10 corporate image.
I configured it using the GPO "Use a common set of exploit protection settings" that makes use of a XML file. Initially, Chrome.exe was not included in the XML file.



I realized that when I opened Chrome, an event ID 10 appeared in

Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode




Process 'DeviceHarddiskVolume2Program Files
(x86)GoogleChromeApplicationchrome.exe' (PID 9740) was blocked
from making system calls to Win32k.sys.




I even explicitly included chrome.exe as an exception in the Program Setting list, forcing OFF in the setting "Disable Win32 system calls". To do that, I just added this code to the XML file:



<AppConfig Executable="chrome.exe">     
<SystemCalls> DisableWin32kSystemCalls="false"/>
</AppConfig>


But nothing changes, and the same event ID appears. One interesting thing is that Chrome seems to work fine, with no error windows or crashes.



Any idea how to solve this situation?










share|improve this question
















I am in the process of implementing Exploit Guard in our W10 corporate image.
I configured it using the GPO "Use a common set of exploit protection settings" that makes use of a XML file. Initially, Chrome.exe was not included in the XML file.



I realized that when I opened Chrome, an event ID 10 appeared in

Application and Service Logs -> Microsoft -> Windows -> Security Mitigations -> Kernel mode




Process 'DeviceHarddiskVolume2Program Files
(x86)GoogleChromeApplicationchrome.exe' (PID 9740) was blocked
from making system calls to Win32k.sys.




I even explicitly included chrome.exe as an exception in the Program Setting list, forcing OFF in the setting "Disable Win32 system calls". To do that, I just added this code to the XML file:



<AppConfig Executable="chrome.exe">     
<SystemCalls> DisableWin32kSystemCalls="false"/>
</AppConfig>


But nothing changes, and the same event ID appears. One interesting thing is that Chrome seems to work fine, with no error windows or crashes.



Any idea how to solve this situation?







google-chrome security exploit






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Feb 19 at 4:05









Pikachu the Purple Wizard

150213




150213










asked Feb 11 at 9:29









YaKsYaKs

32




32













  • Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

    – harrymc
    Feb 11 at 10:14











  • I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

    – YaKs
    Feb 11 at 10:53



















  • Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

    – harrymc
    Feb 11 at 10:14











  • I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

    – YaKs
    Feb 11 at 10:53

















Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

– harrymc
Feb 11 at 10:14





Run Chrome and then in PowerShell enter the command Get-ProcessMitigation -Name chrome -RunningProcesses. Look under "System Call:" and let us know your settings. On mine it says "DisableWin32kSystemCalls : OFF, Audit : OFF, Override SystemCall : False". If yours is different, please share exactly how and where you Win32k System Calls.

– harrymc
Feb 11 at 10:14













I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

– YaKs
Feb 11 at 10:53





I also have "System Call:DisableWin32kSystemCalls: OFF Audit: OFF Override SystemCall : False, and I still see the event appearing every time I open Chrome. You dont have the event? maybe another GPO setting provoking this behaviour?

– YaKs
Feb 11 at 10:53










1 Answer
1






active

oldest

votes


















0














To my great surprise I have the same warning.



To my greater surprise, I also have this same warning for browser_broker.exe,
which is a component of Microsoft Edge. As its name suggests, this is probably
the component that decides which browser to call for a URL.



Since this warning is happening on Microsoft's own software when it's working correctly,
and is also happening on Chrome when it's working correctly,
I think that it is harmless and unavoidable.






share|improve this answer
























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1404366%2fexploit-guard-blocking-chrome-making-calls-win32k-sys%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    0














    To my great surprise I have the same warning.



    To my greater surprise, I also have this same warning for browser_broker.exe,
    which is a component of Microsoft Edge. As its name suggests, this is probably
    the component that decides which browser to call for a URL.



    Since this warning is happening on Microsoft's own software when it's working correctly,
    and is also happening on Chrome when it's working correctly,
    I think that it is harmless and unavoidable.






    share|improve this answer




























      0














      To my great surprise I have the same warning.



      To my greater surprise, I also have this same warning for browser_broker.exe,
      which is a component of Microsoft Edge. As its name suggests, this is probably
      the component that decides which browser to call for a URL.



      Since this warning is happening on Microsoft's own software when it's working correctly,
      and is also happening on Chrome when it's working correctly,
      I think that it is harmless and unavoidable.






      share|improve this answer


























        0












        0








        0







        To my great surprise I have the same warning.



        To my greater surprise, I also have this same warning for browser_broker.exe,
        which is a component of Microsoft Edge. As its name suggests, this is probably
        the component that decides which browser to call for a URL.



        Since this warning is happening on Microsoft's own software when it's working correctly,
        and is also happening on Chrome when it's working correctly,
        I think that it is harmless and unavoidable.






        share|improve this answer













        To my great surprise I have the same warning.



        To my greater surprise, I also have this same warning for browser_broker.exe,
        which is a component of Microsoft Edge. As its name suggests, this is probably
        the component that decides which browser to call for a URL.



        Since this warning is happening on Microsoft's own software when it's working correctly,
        and is also happening on Chrome when it's working correctly,
        I think that it is harmless and unavoidable.







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Feb 11 at 11:10









        harrymcharrymc

        265k14274583




        265k14274583






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Super User!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1404366%2fexploit-guard-blocking-chrome-making-calls-win32k-sys%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Сан-Квентин

            Алькесар

            Josef Freinademetz