j-gray 35 Posted October 12, 2017 Share Posted October 12, 2017 We've run into the issue where Win10 clients have both Agent and AV (v.6.5.2094.0) installed, however, they only register the Agent as an installed app in the ERA console. Any attempts to remove or upgrade the AV fail with the following: Error 1921. Service 'ESET Service' (ekrn) could not be stopped. Verify that you have sufficient privileges to stop system services. Windows Defender is not running and Self-defense is disabled, as well. Is there a method (besides Safe Mode) to stop the service and allow a remote upgrade? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,072 Posted October 12, 2017 Administrators Share Posted October 12, 2017 To start off, please collect logs with ELC and supply me with the generated archive. If too big to attach, upload it to a safe location and pm me a download link. Link to comment Share on other sites More sharing options...
j-gray 35 Posted October 12, 2017 Author Share Posted October 12, 2017 For anyone else encountering this issue with ESET and Win10, I found the following to work: Remotely disable the service: sc \\computername config ekrn start=disabled Stop the service remotely with PSTools: pskill \\computername ekrn I found that the 'sc' command was unable to remotely stop the ekrn service, hence pskill. Disabling the service first keeps it from restarting immediately after killing it. Once this was done, the upgrade task was able to complete using ERA. Link to comment Share on other sites More sharing options...
Recommended Posts