WDAC Audit Mode - Preventing .ocx files from loading

Question

WDAC Audit Mode - Preventing .ocx files from loading

71644982 0

Hi, I hope someone can help with this. When we have a WDAC policy active in audit mode we see it preventing .ocx modules from loading. When we disable the audit mode WDAC policy the modules are able to load without issue.

When WDAC policy is not on the device, the module Will load: User's image

When Audit mode Policy is active on the device, the module will not load:

User's image

These are the current WDAC policy settings we have defined:

User's image

We don't see WDAC creating any Block events in Audit logs. Any ideas?

Barter, Rob 0 Reputation points

2023-09-22T15:10:44.6733333+00:00
We are seeing the same issue with an old GRAPHS32.OCX. If you do not install a WDAC ruleset (thereby not enabling WDAC) then the ocx loads fine. If you install a ruleset, even with Audit enabled, the ocx fails to load. No messages in CodeIntegrity log file.

$DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b" Copy-Item -Path $PolicyBinary -Destination $DestinationBinary -Force Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary}

1 answer

Your answer

Barter, Rob 0 Reputation points

2023-09-22T15:10:44.6733333+00:00

We are seeing the same issue with an old GRAPHS32.OCX. If you do not install a WDAC ruleset (thereby not enabling WDAC) then the ocx loads fine. If you install a ruleset, even with Audit enabled, the ocx fails to load. No messages in CodeIntegrity log file.

$DestinationBinary = $env:windir+"\System32\CodeIntegrity\SiPolicy.p7b" Copy-Item -Path $PolicyBinary -Destination $DestinationBinary -Force Invoke-CimMethod -Namespace root\Microsoft\Windows\CI -ClassName PS_UpdateAndCompareCIPolicy -MethodName Update -Arguments @{FilePath = $DestinationBinary}

Answer 1

Hello,

Thank you for your question and for reaching out with your question today.

The error messages you provided indicate issues related to loading and registering the .ocx module. Given that you're not seeing block events in the audit logs, this suggests that the issue might not be directly related to WDAC blocking.

Since you're facing specific errors related to registering the .ocx module, here are some ideas for you to investigate:

The error message "The module 'mhlabl32.ocx' was loaded but the call to DllRegisterServer failed with error code 0x80040200" indicates a problem with registering the DLL. This could be related to permissions, dependencies, or conflicts.
Ensure that the user account attempting to register the DLL has sufficient permissions. Run the command prompt or the application attempting registration as an administrator.
.ocx files often have dependencies on other libraries. Ensure that all required dependencies for 'mhlabl32.ocx' are present and properly registered.
There could be conflicts with other versions of the same or related DLLs. Check if there are any other versions of the 'mhlabl32.ocx' or related files present on the system and resolve any version conflicts.
.ocx files are typically COM components. Ensure that the COM component registration settings are correctly defined and not conflicting with other components or policies.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Share via

WDAC Audit Mode - Preventing .ocx files from loading

1 answer

Your answer