PuterCare

This is something I had noticed myself but have also had several customers call about, it started within the past month. I noticed that when in Outlook (Office 365 install), the "Detected Items" folder in the left pane will flash/flicker randomly and is also duplicated 2 or 3 times. It gets even stranger when I click the "Detected Items" folder, if I click one of the instances it opens an empty folder but if I click the other instance then Outlook rapidly flicks between the two instances forcing me to have to restart Outlook so I can get into another mail folder or do anything and in some cases even crashes Outlook. I know this folder is used by Eset so though the logical place to start would be here. I have logged into OWA and deleted all instances of the Detected Items folder but multiples are recreated when I next open Outlook and the same behaviour is observed. So far I have only noticed this when using Endpoint Security.

Is anyone able to confirm the TLS version used for notifications? I'm running out of ideas so wondered if it is using TLS 1.0/1.1?

Any more ideas? When I get time I will try migrating my DB to a fresh VA but not likely to have time for a while yet,

Thanks for the reply but I have already generated a new app password and tried an existing app password that I use for other reporting services. That was the thread I used to get the Auth type and was the first time I have seen outlook.office365.com used as the server so tried that too but no use.

This is now resolved, in case it helps anyone I logged into the VA and enabled Webmin, I then accessed Webmin using a web browser, Servers section, ESMC then there was an option to repair ESMC Agent Connection. I entered "localhost" for the Hostname and the ESMC port then clicked the repair button and it fixed it and updated to 7.1 as I had this task queued from last year.

I have been having trouble setting up SMTP using an Office 365 exchange mailbox. I have searched this forum and found numerous threads where people had issues and checked working configs against my own and just can't work out what is wrong. My current config: I have MFA enabled and have generated an app password, the same account works fine on other devices where I set up SMTP. I have tried using outlook.office365.com as the server too, also tried port 25, TLS and a few auth types but nothing works. Any ideas where I am going wrong? I know the login credentials are valid so it is as if it's the auth type or perhaps my VA is somehow using an old TLS standard which Microsoft have now blocked? I have no outbound firewall. Thanks

I've pulled those logs and opened a support ticket with them attached. I've not received the email confirmation yet but hopefully that will arrive shortly.

Bump, any ideas??

Hi all, I changed my router and at the same time also changed the domain used for DDNS. Since then, I can load ESMC and correctly monitor client computers, push policies installs etc. but the ESMC VA shows as disconnected so I am unable to update the components to 7.1. When I open the details tab of my VA in the computers section, the FQDN shows my old DDNS domain whereas now I use my website domain with a CNAME record pointing to my new DDNS domain. How can I either update the FQDN so my ESMC server shows and I can upgrade the components or add the server as a new device to the computers list? Thanks

Thanks, can a GPO be used with the AIO? My only other reservation is the AIO would install a static version of the agent but doesn't the script download and install the latest version? Therefore less intervention needed? I know I can update the agent from ESMC but then that's an extra required step. The way I have it set up is that any computer that joins this local domain has the agent installed automatically, then I verify it's an authorised system in ESMC and remotely push the relevant install.

I think you've solved it! I was at another affected office today and that user had a space in their name, I created a temp user account with no space and the agent installed successfully. Thanks for your help on this, is the best method to use the AIO agent installer for such systems?

In the case of todays system, there is a space in the local username therefore the path to the %temp% dir has a space in it. This sounds like a credible cause, when I set up users I don't use spaces but some systems at different offices were not set up by me. I will try this out when I am next able to get onto an affected machine and see if it helps!

I ran the AIO installer and the agent and program have installed successfully. I do need to try and fix this issue though so the agent can be installed independently so if you have any more ideas please let me know. Thanks

I removed EES, rebooted, ran the bat file and had the same issue. I then disabled Windows Defender realtime and the same issue again.

I disabled protection, and then disabled HIPS in the advanced settings (although the toggle in the normal settings remained on and green) and it still failed. I am going to remove EES and try again.

EES is already installed, no changes to the default config (by me at least) and it is already installed on the other systems where the agent install works however EES is a common denominator between all the systems with an issue so will disable protection and try again!

Sorry for the delay, I was no longer working on that client site so took time to get back onto an affected system. It is Windows 10 Pro x64 1903, I have identical systems in the same office that work perfectly. Across 4 different offices with different hardware and different agent installers I have a single machine in each office that has exactly the same problem. All other offices have no issues at all, really puzzling! I just ran SFC and rebooted - same issue. Line 184 reads: exitCode = WshShell.Run(command, 0, True) ewong - yes there is a sha1sum.exe created in %temp% when the bat file is ran. There is also the agent_x64.msi, two certificate files, uacinstall.vbs.

Is there anything else I can try?

Yes that’s right. I think the uacinstall.vbs script runs but it then fails as per the screenshot on my original post. It is the same error on all 4 systems. Other scripts run fine so it doesn’t seem to be the computers blocking scripts from running, it seems to be something specific to the uacinstall script. I opened in notepad++ and checked line 184 but nothing obvious there to cause a problem, but this is outside of my skill set so might be missing something.

I now have 4 different systems with this same issue, all from different offices, not domain connected and no policies applied. All other systems in all 4 offices work fine. Any idea on the cause or what more I can do to try and fix? Thanks

I did as you suggested and the test vbs ran fine from temp, I then copied all of the Eset files from %temp% to a new folder on C:\ and ran the vbs from an elevated CMD and the same issue occurred. Any other ideas? Thanks

It is a standalone workgroup computer with no policies in place, I don't think there is any software on there that would block (unless it is Windows doing it). I will see if I can find a script that I can put in there and try to run.

Bump

Any ideas? Thanks

Log attached, thanks. Logfile.zip