After pushing out clients for the MS Application
Compatibility Toolkit on our domain via GPO, UACCEEventLog 301 occurs a few times per second in the event log. Several Thousand per hour.
One test i need to do is logon with Administrator to see if these events go away while Admin, but of course that is not a fix.
This is only part of the event log entry, but is the most readable and clearly indicates yet another problem with Antivirus software. But still no fix.
Originally, i posted this In Words and Bytes, but then edited it to make it much easier to read. LocalMachine\Users do have Read Access to this key. For a test, i added "Domain Users" but there are many more events for other parts of the registry and for Administrators.
<XML>
<TYPE>
UacceRegistryVirtualization
</TYPE>
<EXENAME>smcgui.exe</EXENAME>
<EXEPATH>c:\program files\symantec\symantec endpoint protection </EXEPATH>
<APINAME>RegOpenKeyA</APINAME>
<REGKEYNAME>
HKEY_LOCAL_MACHINE\SOFTWARE
\Symantec\Symantec Endpoint Protection\AV\Storages
\SymHeurProcessProtection\RealTimeScan\0
</REGKEYNAME>
<RESTRICTEDBYACL>FALSE</RESTRICTEDBYACL>
<DESIREDACCESS>MAXIMUM_ALLOWED</DESIREDACCESS>
<REGVALUENAME></REGVALUENAME>
<REGVALUETYPE>0x00000000</REGVALUETYPE>
<REGVALUEDATA></REGVALUEDATA>
<CURRENTGROUP>Users</CURRENTGROUP>
</XML>
