Have used EMET 3 with Win 7 64 bit and XP with no problems.

Installed EMET 4 with same configuration but GUI never shows anything "Running EMET" even though apps are configured?

EMET 3 GUI always showed "Running EMET" applications.

Went back to EMET 3 as EMET 4 doesn't seem ready for prime time.

Hi Chas We,

Welcome to the EMET Support forum. I am sorry to learn that you are experiencing this issue.

This issue is very similar to the issue that another forum member encountered with EMET 3.5 Tech Preview and that I can now confirm that EMET 4.0 also exhibits this issue. Please see the most recent post in the following thread that describes the issue with EMET 4.0:

http://social.technet.microsoft.com/Forums/security/en-US/0b10c1e4-cbdb-4dba-af3a-1fdf3a7a6a98/emetconf-will-not-open-and-emetnotifier-never-notifies

To verify if what you are experiencing is the same issue, I would suggest downloading and running Sysinternals Process Explorer. Once open choose View->Lower Pane->DLLs and click any running process that is supposed to be protected by EMET. If you see EMET.dll or EMET64.dll (for 64 bit processes) in the list at the bottom of your screen (you may need to scroll through that list), then EMET is protecting the application, but EMET is not reporting this correctly to you.

Another issue that I have encountered that is related but is not the same is the following:

When adding an application to the list of EMET protected applications, if you use the Add Wildcard option (see the screenshot below) and enter an application, occasionally you will receive an error that the new settings failed to be applied.

Direct Link to Image:

http://i742.photobucket.com/albums/xx69/Jimboc/Microsoft/Microsoft_EMET_40_Wildcard.png

If you check if that application is Running EMET from the EMET lists of Running Processes (that you mentioned in your post), that application will not be Running EMET.

I have found the best way to resolve this is to remove that newly added application from the list of protected applications. Restart your computer and try adding the application using the wildcard button again.

You should then be told that restarting that program will be required for the settings to take effect. If you close and open that program again, it should now show as Running EMET with a green check mark (or at very least you will see the EMET DLL in the DLL list shown by Process Explorer).

This Add Wildcard button is discussed on page 18 of the EMET 4.0 User Guide (a PDF file located in your EMET installation folder) which is located in one of the following folders:

32 bit Windows:    C:\Programs Files\EMET 4.0

64 bit Windows:    C:\Programs Files (x86)\EMET 4.0

As I mentioned in the final post of the above linked to thread, the Running EMET status check mark not appearing is misleading. I have also reported this issue to the EMET Feedback email address.

I hope the above information is of assistance to you. If I can provide any further advice, please let me know.

Thank you and have a good day.

Hi Chas We,

Welcome to the EMET Support forum. I am sorry to learn that you are experiencing this issue.

This issue is very similar to the issue that another forum member encountered with EMET 3.5 Tech Preview and that I can now confirm that EMET 4.0 also exhibits this issue. Please see the most recent post in the following thread that describes the issue with EMET 4.0:

http://social.technet.microsoft.com/Forums/security/en-US/0b10c1e4-cbdb-4dba-af3a-1fdf3a7a6a98/emetconf-will-not-open-and-emetnotifier-never-notifies

To verify if what you are experiencing is the same issue, I would suggest downloading and running Sysinternals Process Explorer. Once open choose View->Lower Pane->DLLs and click any running process that is supposed to be protected by EMET. If you see EMET.dll or EMET64.dll (for 64 bit processes) in the list at the bottom of your screen (you may need to scroll through that list), then EMET is protecting the application, but EMET is not reporting this correctly to you.

Another issue that I have encountered that is related but is not the same is the following:

When adding an application to the list of EMET protected applications, if you use the Add Wildcard option (see the screenshot below) and enter an application, occasionally you will receive an error that the new settings failed to be applied.

Direct Link to Image:

http://i742.photobucket.com/albums/xx69/Jimboc/Microsoft/Microsoft_EMET_40_Wildcard.png

If you check if that application is Running EMET from the EMET lists of Running Processes (that you mentioned in your post), that application will not be Running EMET.

I have found the best way to resolve this is to remove that newly added application from the list of protected applications. Restart your computer and try adding the application using the wildcard button again.

You should then be told that restarting that program will be required for the settings to take effect. If you close and open that program again, it should now show as Running EMET with a green check mark (or at very least you will see the EMET DLL in the DLL list shown by Process Explorer).

This Add Wildcard button is discussed on page 18 of the EMET 4.0 User Guide (a PDF file located in your EMET installation folder) which is located in one of the following folders:

32 bit Windows:    C:\Programs Files\EMET 4.0

64 bit Windows:    C:\Programs Files (x86)\EMET 4.0

As I mentioned in the final post of the above linked to thread, the Running EMET status check mark not appearing is misleading. I have also reported this issue to the EMET Feedback email address.

I hope the above information is of assistance to you. If I can provide any further advice, please let me know.

Thank you and have a good day.

• Edited by JamesC_836 Wednesday, July 10, 2013 8:47 PM Minor update

Hi Chas We,

Welcome to the EMET Support forum. I am sorry to learn that you are experiencing this issue.

This issue is very similar to the issue that another forum member encountered with EMET 3.5 Tech Preview and that I can now confirm that EMET 4.0 also exhibits this issue. Please see the most recent post in the following thread that describes the issue with EMET 4.0:

http://social.technet.microsoft.com/Forums/security/en-US/0b10c1e4-cbdb-4dba-af3a-1fdf3a7a6a98/emetconf-will-not-open-and-emetnotifier-never-notifies

To verify if what you are experiencing is the same issue, I would suggest downloading and running Sysinternals Process Explorer. Once open choose View->Lower Pane->DLLs and click any running process that is supposed to be protected by EMET. If you see EMET.dll or EMET64.dll (for 64 bit processes) in the list at the bottom of your screen (you may need to scroll through that list), then EMET is protecting the application, but EMET is not reporting this correctly to you.

Another issue that I have encountered that is related but is not the same is the following:

When adding an application to the list of EMET protected applications, if you use the Add Wildcard option (see the screenshot below) and enter an application, occasionally you will receive an error that the new settings failed to be applied.

Direct Link to Image:

http://i742.photobucket.com/albums/xx69/Jimboc/Microsoft/Microsoft_EMET_40_Wildcard.png

If you check if that application is Running EMET from the EMET lists of Running Processes (that you mentioned in your post), that application will not be Running EMET.

I have found the best way to resolve this is to remove that newly added application from the list of protected applications. Restart your computer and try adding the application using the wildcard button again.

You should then be told that restarting that program will be required for the settings to take effect. If you close and open that program again, it should now show as Running EMET with a green check mark (or at very least you will see the EMET DLL in the DLL list shown by Process Explorer).

This Add Wildcard button is discussed on page 18 of the EMET 4.0 User Guide (a PDF file located in your EMET installation folder) which is located in one of the following folders:

32 bit Windows:    C:\Programs Files\EMET 4.0

64 bit Windows:    C:\Programs Files (x86)\EMET 4.0

As I mentioned in the final post of the above linked to thread, the Running EMET status check mark not appearing is misleading. I have also reported this issue to the EMET Feedback email address.

I hope the above information is of assistance to you. If I can provide any further advice, please let me know.

Thank you and have a good day.

• Edited by JamesC_836 Wednesday, July 10, 2013 8:47 PM Minor update