Endpoint Protection

Periodically throughout the day one of the workstation I work with receives the notification ""Blocked explorer.exe from accessing AutoRun.inf...Autorun has been blocked. Check the control log for more details" which is how SEP should be protecting against Autorun viruses, but my problem is when AutoRun is blocked, explorer.exe crashes and the service has to be manually restarted.

Does anyone have an idea as to why the block is causing explorer.exe to crash and/or how to fix the issue while keeping the Autorun block in place?

The workstation does not have any external drives plugged in when this occurrs. 

What is the exact SEP client version this occurring on? And is this Windows 10?

Version 12.1.7004.6500.105 on Windows 10

Does this happen on other Win10 clients when that rule is triggered or is it specific to this machine?

From what I have seen so far it is only happening on the one Dell Laptop plugged into a docking station.

I'd see if SymDiag shows any issues with the client:

Download SymDiag to detect Symantec product issues

Maybe a repair of the client or an uninstall/reinstall will correct it, if it has an issue. 

Did you ever find a solution to this.  I'm experiencing this with a Dell TB16 docking station.

Thanks!