IAStorDataMgrSvc wants access to my documents

[GeoffF100]

Windows 10 Folder Access Control is complaining about IAStorDataMgrSvc. This appears to be a legitimate program for managing RAID:

https://www.bleepingcomputer.com/startu ... 26954.html

I am not using RAID. I am using an SSD as a system drive, and a hard drive for data. The link above suggests that this program runs as a Windows service, and I can set the Startup Type to Manual rather than automatic. Here are some instructions:

https://www.askvg.com/beginners-guide-t ... services/#

Is this a good idea?

P.S. I believe that I recently allowed the Intel drivers to update, and this is probably what caused the problem.

[Breelander]

Windows 10 Folder Access Control is complaining about IAStorDataMgrSvc. This appears to be a legitimate program for managing RAID...
...The link above suggests that this program runs as a Windows service, and I can set the Startup Type to Manual rather than automatic. ...

Is this a good idea?

P.S. I believe that I recently allowed the Intel drivers to update, and this is probably what caused the problem.

Whether it's a good idea or not I can't tell - but I can say that it won't sort out the Controlled Folder Access problem.

Windows Defender Controlled Folder Access is protection against ransomware. It blocks access to the user folders for any unknown app, only allowing access to a limited number of known MS and third-party apps on its whitelist.

For an app or executable that's being blocked, as long as you trust it you can add it to the list of apps that are permitted access.

https://www.tenforums.com/tutorials/878 ... -10-a.html

[Slarti]

Windows 10 Folder Access Control is complaining about IAStorDataMgrSvc. This appears to be a legitimate program for managing RAID:

https://www.bleepingcomputer.com/startu ... 26954.html

I am not using RAID. I am using an SSD as a system drive, and a hard drive for data. The link above suggests that this program runs as a Windows service, and I can set the Startup Type to Manual rather than automatic. Here are some instructions:

https://www.askvg.com/beginners-guide-t ... services/#

Is this a good idea?

P.S. I believe that I recently allowed the Intel drivers to update, and this is probably what caused the problem.

Yes, stop the service and set it to manual as there have long been problems with it.
Also instances of malware have been known to disguise themselves as it. So if you don't have RAID you don't want it.

Slarti

[GeoffF100]

For an app or executable that's being blocked, as long as you trust it you can add it to the list of apps that are permitted access.

That is the issue. Is the executable trying to get in the legitimate one or malware? The legitimate program does not have any obvious business poking around in my Documents folder. If it is legitimate, why is it not on Microsoft's white list? I do not want to take any risk here, unless I need to do so.

[Slarti]

Whether it's a good idea or not I can't tell - but I can say that it won't sort out the Controlled Folder Access problem.

Surely if it is not running then there won't be a Controlled Folder Access problem?

Slarti

[Breelander]

That is the issue. Is the executable trying to get in the legitimate one or malware? The legitimate program does not have any obvious business poking around in my Documents folder...

It may not be the Documents folder it was trying to access. The Desktop is also protected, also memory. The details of exactly what and where it was being blocked from accessing would be in the notifications. If the notification is no longer there, it's also recorded in the Event Log. Look in...
Application and Service Logs/Microsoft/Windows/Windows Defender/Operational
...and filter for Event ID 1123.

[GeoffF100]

Thank you for that Bree. It was Event ID: 1127 and User: SYSTEM. The log entry was:

Controlled Folder Access blocked C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe from making changes to memory.
Detection time: 2018-06-15T12:14:14.419Z
User: NT AUTHORITY\SYSTEM
Path: \Device\Harddisk0\DR0
Process Name: C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
Signature Version: 1.269.1292.0
Engine Version: 1.1.14901.4
Product Version: 4.16.17656.18052

It looks kosher to my inexpert eyes. It looks as through the Intel Rapid Storage is just looking at my hard drive rather than its contents. I expect that it is safe to allow access. The safest course is probably to do nothing and wait for Microsoft to fix the problem. I have not had more than one of these messages during a session, and often do not get any at all. Nonetheless, it does not look as though I have to worry that my machine has been infected. I ran a Windows Defender full scan and an offline scan yesterday, and neither picked up anything.

[Breelander]

Controlled Folder Access blocked C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe from making changes to memory.

...It looks kosher to my inexpert eyes. It looks as through the Intel Rapid Storage is just looking at my hard drive rather than its contents. I expect that it is safe to allow access. The safest course is probably to do nothing and wait for Microsoft to fix the problem...

So it was blocked from changing memory and not your Documents folder. The fix would be for MS to add the recently updated version of IAStorDataMgrSvc.exe to Defender's built-in whitelist - it's not just the app name stored there, there's also a hash code to uniquely identify the executable.

That may be done automatically some time soon by a Defender definitions update through windows update. If MS don't get round to it shortly, or you notice any problems with the Intel RST then you could always add it to the list yourself. I'd leave it for a while and see if MS issue an update.

[GeoffF100]

Thank you very much, that all makes sense to me now.

[Infrasonic]

There was another controlled folder thread a while back where we discussed more broadly and I linked over to the Windows Ten forum tutorial/discussion...viewtopic.php?f=39&t=11424

Since the 1803 update I got a few 1127 alerts (I'd had a couple of 1123 previously) and whitelisted them, some were MS rather than third party.
I didn't know about the defender updates whitelisting, so that's good to know. (Thanks Bree!)

In event viewer once you've drilled down to the relevant page you can click the column heading to get the event ID, which will group them.
Dead easy to see all the 1123/1127 events together then, especially if you missed them on the original alerts or hadn't worked out how to whitelist them easily at the time. (There's a cut and paste file path solution on the W10 forum link, although I've just been using the old fashioned typing it all out longhand method.)

[mc2fool]

Controlled Folder Access blocked C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe from making changes to memory....

So it was blocked from changing memory and not your Documents folder.

I must admit, even though it says so right there in the setting description, I'd somehow missed that Controlled Folder Access also trapped changes to memory ... it's not exactly self-evident from the naming, and I'd always assumed (obviously incorrectly) that memory hacking was covered by Exploit protection.

However, I can't find, on admittedly just a brief google, just what changes to memory CFA catches -- after all, every program changes memory, so I assume it must be referring to out-of-process memory (i.e. that of other processes and/or Windows itself).

But then what about Device security - Core isolation - Memory integrity ... ?

[Breelander]

I must admit, even though it says so right there in the setting description, I'd somehow missed that Controlled Folder Access also trapped changes to memory ... it's not exactly self-evident from the naming, and I'd always assumed (obviously incorrectly) that memory hacking was covered by Exploit protection...

The memory protection in controlled folder access seems to be new in 1803, I'd not seen it in action before either. I think it is in addition to the exploit protection. Also new in 1803, for the first time MS now refer to controlled folder access as 'Ransomware protection' in at least one part of Settings.