Illegal Meta Character in Value

MSZ

You can do both, as both achieves the same goal. However, I wouldn't recommend turning off the illegal meta character violation, as that way all meta characters will be allowed and you're losing some of the inherent and configurable security that way.

Your second option disables the particular value for ALL parameters, again this will work but, my preference, would be (if you can) to manually add the parameter that is seeing the violation (false positive i assume) and allow the meta character on this parameter alone. This means you've loosened the security policy as little as possible to mitigate a false positive.

Hope this helps,

N