Windows Defender - Controlled Folder Access

Question

Hi,

some of our clients generate the following Windows events.

The controlled folder access has C:\Program Files\OCS Inventory Agent\OCSInventory.exe changes to storage.
Detection time: 2021-03-15T07:42:54.452Z
Users: (unknown user)
Path: \Device\Harddisk0\DR0
Process name: C:\program files\OCS inventory agent\OCSInventory.exe
Security version: 1.333.438.0
Module version: 1.1.17900.7
Product version: 4.18.2102.3

(German)
Der überwachte Ordnerzugriff hat C:\Program Files\OCS Inventory Agent\OCSInventory.exe daran gehindert, Änderungen am Speicher durchzuführen.
Erkennungszeit: 2021-03-15T07:42:54.452Z
Benutzer: (unknown user)
Pfad: \Device\Harddisk0\DR0
Name des Prozesses: C:\Program Files\OCS Inventory Agent\OCSInventory.exe
Sicherheitsversion: 1.333.438.0
Modulversion: 1.1.17900.7
Produktversion: 4.18.2102.3

Is this normal?

Agent-Version :OCS-NG_WINDOWS_AGENT_v2.8.0.0

Thanks in advance.

Best regards

stetze

Answer 1

https://support.microsoft.com/en-us/windows/allow-an-app-to-access-controlled-folders-b5b6627a-b008-2ca2-7931-7e51e912b034

quote

Occasionally, an app that is safe to use will be identified as harmful. This happens because Microsoft wants to keep you safe and will sometimes err on the side of caution; however, this might interfere with how you normally use your PC. You can add an app to the list of safe or allowed apps to prevent them from being blocked.

Answer 2

Thank you. I have made an exlusion for the clients in the gpo.