After Whitelist software run normally for about 3 months since it is installed in WINCC server.

One day, one new monitoring UI of WINCC was open and cannot run normally, and the whitelist software reported that the process has been blocked. Then operator pulled the machine to observing group directly in the management center (EPO) of whitelist software to try to get more running process information and intend to add them into the list of the whitelist.

          Then the machine run very slowly and customer had to disable all of the whitelist software since he worry about the software influence the normal production.

          Maybe, customer need to disable whitelist mode and then set the machine into observing mode.

         Can you  coordinate the related expert of HQ to help solve this problem?

         On the other hand, there are two problems during deployment :

1.      The latest version of McAfee whitelist software cannot be compatible with the PCS 7, can you coordinate McAfee to support their latest version to support PCS 7. Customer is not very happy with this problem. That means that they cannot update the version of the whitelist software.

2.      Some functions of the whitelist software had to been disabled, or else, the whitelist software will make the system run very slowly. Fox example, only MD5 checking is enabled, and the memory protection, Execution Control and SAU (Script-as-Update)are disabled. 

And also run the following command to disable rollback funciton

sadmin config set IsInvbackupEnabled=0