JME

Answer from ESET support, workaround works: Exclude ekrn.exe process from Citrix hooking: https://support.citrix.com/article/CTX107825

Hi Marcos, Thanks, I will provide them as soon as I can. Problem is related to Citrix, but also to Miccrosoft: some of their new patches break ESET Service). Does ESET use .NET Framework ?

Hi Marcos, I know that Protected Service should be enabled, as I mention it on my previous post. I have no choice: - all our servers were working without antivirus and that's a bigger issue. Downgrading to 6.x will break Protected Service too. And if I need to upgrade after, it takes time again. When we did the upgrade, sometimes the automatic upgrade (via ESMC) failed and we need to install EFS manually and in before uninstalling all in Safe Mode. Do you mean that the issue doesn't occur with Protected service disabled? Yes, right. What do you mean by ESET Log Collector logs ? Regards,

Hi, I found something. 1/ ESET 7.x registry key The ESET Service doesn't start at boot up => Need to be started manually The registry value "LaunchedProtected" used to protect ESET Service. This value doesn't exist on ESET 6.x version HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn LaunchedProtected = 3 Deleting this value or changing it to "0" doesn't do the trick because it is recreated at every server restart 2/ .NET Framework updates on XenApp servers only After some new Windows updates, the ESET Service doesn't start at all. KB4514604 // KB4514599 // KB4498963 The solution is to revert to ESET File Security 6.x. but it's a mess because we have lots of XenApp servers. I found a workaround. This workaround creates a security hole, so use it with caution. 1/ Start Windows in Safe Mode 2/ Change the value LaunchedProtected to 0 3/ Change Owner on HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ekrn Server\Administrator insteaf of System 4/ Change Group / Users permissions "Read" instead of "Full Control" 5/ Reboot in Normal mode *Do not revert Owner because ESET is using System and will changeLaunchedProtected to 3 after a second server reboot. Hope ESET / Microsoft / Citrix will publish a definitive solution.

Yes, the problem persists. I already raised a ticket with my local customer. Regards,

Hi, We upgraded our XenApp Servers (version 7.9) from ESET File Security 6.5.12014.1 to 7.1.12006.0 Since this upgrade, ESET Service doesn't start even if we try to manually. We tried uninstalling and reinstalling: no changes. We tried repairing and it gives us an error: the .dll files cannot be removed because of rights. Can you help us resolving this issue ? Regards,