ESET Endpoint Security 6.5 cant install on Windows 10 with Creators Update

[Knife 0]

Hi,

my problem is with new notebooks with preinstalled and updated windows 10 creators update.

Cant install from era, or with standalone installer neighter. It says, the admin hasnt enough privileges to start eset service... Internet security version 10 runs great, but isnt an option.

Beta 6.6 works, but it is beta. When will it be released? Or is there any option to install 6.5 on build 15063.332 (version 1703)?

Thanks! 

[Marcos 5,125]

Been getting this error until I renamed "C:\Program Files\Windows Defender\MsMpEng.exe" (Windows Defender service executable) before starting upgrade. It appears that WD activates during upgrade (which is fine and expected) but it holds some files for too long that it prevents ekrn from starting. We are investigating if there's something we could about it on our part.

[Knife 0]

Thanks!

I hope soon will be available version 6.6.

 

[Peter Randziak 1,140]

Hello,

it will take some time to have EP 6.6 generally available, but our developers are working on a hot fix for the version 6.5 as well. 

Regards, P.R.

[rkok 3]

any update on this issue?

[Marcos 5,125]

20 minutes ago, rkok said:

any update on this issue?

A hotfix should be available soon. Not sure about other vendors affected by this issues triggered by recent changes in Windows Defender.

[jimwillsher 65]

rkok, there's a beta of 6.6 that I've installed successfully on build 1703 machines that wouldn't otherwise install 6.5. Just in case that's of use to you?

[avielc 54]

@jimwillsher Beta doesn't help in production environment, I can't put such product on employees computer and "hope" there won't be any bugs.

@Marcos - is there an estimate please, I don't need to be precise on timing, but telling me: a week from now\month from now, is also good just to be able and report it onward in the organization.

 

Thank you for noticing and working on a fix. <- this goes without saying. But I still think it's important to say it out loud.

[Marcos 5,125]

The plan is to release Endpoint 6.6 in July. However, I'd strongly recommend disabling Defender via group policy as it's the only reliable solution to these issues.

[avielc 54]

1 minute ago, Marcos said:

The plan is to release Endpoint 6.6 in July. However, I'd strongly recommend disabling Defender via group policy as it's the only reliable solution to these issues.

I was referring to the hotfix @Marcos, is there an ETA for that?

I would look that option up. but I prefer not shut down such option to computer that might not be protected\BYOD

[Peter Randziak 1,140]

Hello Avielc,

I just had a call with the Dev team. 

There is still an issue with upgrades (clean installation works O.K.), they are looking into it as we speak and will decide how to proceed, but we cannot give any promises so far :-(

Will try to keep you posted.

Regards, P.R.

[Marcos 5,125]

30 minutes ago, avielc said:

I would look that option up. but I prefer not shut down such option to computer that might not be protected\BYOD

You can re-enable Defender via GP easily if you decide to uninstall ESET. However, to prevent clashes of 2 real-time protections running at a time, we strongly recommend disabling WD before installing ESET.

[avielc 54]

@Peter Randziak - I've been messing for 2 days with the installations of new computers all due to that issue. and i've been breaking my head trying to figure it out.

Currently it looks like the "egui" doesn't run on computer restarts. This is a MAJOR issue for us, I'm sure it'll be a bigger issue when more clients will notice it. Worth double checking with the Dev Team.  ( provided more info on the other thread) All related to clean install + web console agent and then AV installation to the latest.

Please do look it up, as it is a serious matter.

@Marcos - If its just a matter of realtime protection I can look it up. Though I would prefer making sure it can be enabled automatically in case ESET isn't present on the machine. 
And I need to put more weight on this line

"This didn't happen on previous updates of Windows. Thus disabling WD was never a recommendation in the first place, and shouldn't become one. Either an application works natively with the platform, or it doesn't.

If things have changed due to latest update they need to be addressed or Terms of Agreement needs to be updated."

Understand my point? (I really do believe when something breaks, instead of asking to disable an existing feature of another system, especially when you don't know how it'll affect who-knows how many computers.

 

Looking forward to hear back from you.

Thanks guys for being so supportive and responsive.

[avielc 54]

*update*
I've tried to look it up as well.

Looks like that under "security and maintenance" on windows, under security section there is a request to "update your antivirus" and You need to verify the publisher - aka eset.

When trying to confirm it. there is a quick popup of a command prompt box that tries to run "ecmd.exe" but it's too quick to notice what it is trying to run. can you provide me with some way to debug it? perhaps I can provide some helpful info in that direction?

[Peter Randziak 1,140]

Hello Avielc,

the ESET main GUI is run by ekrn, but I'm not sure why there should be an issues after the system reboot :-( 

May I ask you to retry the behavior with the hotfix release build, which we are about to release on the beginning of the next week.

In case it will persist I will assist you with the troubleshooting.

Regards, P.R.

[avielc 54]

2 hours ago, Peter Randziak said:

Hello Avielc,

the ESET main GUI is run by ekrn, but I'm not sure why there should be an issues after the system reboot :-( 

May I ask you to retry the behavior with the hotfix release build, which we are about to release on the beginning of the next week.

In case it will persist I will assist you with the troubleshooting.

Regards, P.R.

Thank you very much Peter,
Really appreciate the gesture, the offer. This would be exceptionally helpful in the worst case scenario the hotfix wouldn't correct this issue.

 

Aside of that, I'm afraid I wouldn't know why egui.exe doesn't automatically start on itself. I can see ekrn.exe running after system reboot, but not the egui. It does however loads with no issue if i just pick EEAV from the start menu-eset. 
What I don't understand is that "update your Antivirus" alert I receive on the security and maintenance.. really puzzle me, and why it doesn't disappear once i "trust" ESET's app.

Anyways. We will be wiser and more set on a solution after trying the hotfix.

Looking forward, and will be in touch to let you know whether it worked or not. (hopefully not for latter)

 

Thanks again, both you and Marcos.

[foneil 342]

FYI we posted Alert for this issue:

Windows Defender causes freezing issues after installation/update of ESET Smart Security or ESET Endpoint Security

[avielc 54]

On 6/9/2017 at 10:26 PM, foneil said:

FYI we posted Alert for this issue:

Windows Defender causes freezing issues after installation/update of ESET Smart Security or ESET Endpoint Security

Thanks,

Please correct a minor sentence there - (My personal opinion) I do not believe asking clients to disable Windows Defender is a smart or good recommendation. I would prefer waiting for a hotfix that will be released, this issue doesn't seem to disable ESET from running, just disables the ability of the gui to load with windows startup.

[avielc 54]

Thanks for the comment Marcos, However I don't think, business-wise, Microsoft would do such a step as to block all AV software from being able to work together with Defender, or alternatively, require users to disable defender via group policy as a solution.

From my perspective it'll have to be a more fluent solution, either it can co-exist OR when the system detects a verified source of AV software it'll disable the built in AV.

 

Tell me what you think about it. I've never seen or heard about Microsoft's announcements before, but i'll keep an eye open for that now. Thanks to your info (if you could also give me the name of the presentation they usually display, that would be great

 

Thanks again for all your help.

Edited June 16, 2017 by Marcos
Reference to a removed comment removed

[rkok 3]

On 7-6-2017 at 9:05 AM, Marcos said:

A hotfix should be available soon. Not sure about other vendors affected by this issues triggered by recent changes in Windows Defender. 

--------------------------

Reply by Peter : "May I ask you to retry the behavior with the hotfix release build, which we are about to release on the beginning of the next week."

May i ask about the progress on this one? Still need to rollout a fresh win10 image to 1000 (non domainjoined) laptops with ESET included. Beta software is not an option (since not supported)

[avielc 54]

4 minutes ago, rkok said:

May i ask about the progress on this one? Still need to rollout a fresh win10 image to 1000 (non domainjoined) laptops with ESET included. Beta software is not an option (since not supported)

Joining rkok on  that.

It's Wednesday already, and I haven't heard of an update\hotfix on the matter.

 

Thank you.

[MichalJ 434]

Hello, the builds have been tested successfully. We are conducting the formalities, so the hot-fix should be on the web / in ERA repository no later than by Monday, June 19, 2017.

[RoHu 3]

3 hours ago, MichalJ said:

Hello, the builds have been tested successfully. We are conducting the formalities, so the hot-fix should be on the web / in ERA repository no later than by Monday, June 19, 2017.

Thanks Michal for the update.

[avielc 54]

Hi @MichalJ

Any update on the release? I'd like to know how soon I can test\deploy it in my organization to fix this issue.

 

Thanks

[MichalJ 434]

We are in the process of uploading the builds on the FTP, and making them available to partners. In ERA repository / download servers, it should be on Wednesday (there were some process issues on our side). However, if you want, I can arrange with technical support that we will make it available for you as soon as it is uploaded on FTP.