Forbidden process found

[Jagadeshin]

Forbidden process found: A system-owned process that is defined as Forbidden in the Services template is running on the agent. You should terminate the process because it may be causing security problems or damaging your system.

I am getting the following error from the ESM (Enterprise Security Manager). How can i rectiy the same?

[Jeff Schussele]

Hi,

Well I would *first* determine just what the process is. The default ESM template can be a little overboard IMHO.
I would hope the ESM message would tell you just what the process is - at least by PID.
Then if you determine that indeed it should not be running then kill it. But you also need to determine how/why it started so that it won't just restart immediately or on next boot.

Rgds,
Jeff

[Jagadeshin]

Sorry for not mentioning the process name. The process name is chargen.

[Steve Steel · Accepted solution]

Hi

see

http://www.giac.org/practical/Andrew_Scheible_GSEC.doc

http://www.giac.org/practical/Gus_Fritschie_GCUX.doc

Ask Tivoli

Steve Steel