Jump to content

ESET Endpoint Shutting Down After Scheduled Scan with 9.1.2051.0


Recommended Posts

I did open a support ticket for this but posting to see if anyone else is experiencing the same issue.

We manage all of our workstations with ESET Protect. We deployed 9.1.2051.0 yesterday. We have a policy setup to run a nightly scheduled scan with "No Action" after it's complete. We observed every single workstation reboot (during work hours) after the scan was complete. I was actually logged into a system when it happened.

Every single workstation had an Event 1074 in the Windows event logs stating that C:\Program Files\ESET\ESET Security\ekrn.exe initiated a shutdown. I know we could probably just disable the nightly scan but can't due to compliance reasons.

We downgraded to 9.0.2046.0 on all systems. But, anyone else experiencing this?

Edited by Marcos
Title amended
Link to comment
Share on other sites

Just now, Marcos said:

Was a threat detected during the scan?

Not that I'm aware of. If there was, it didn't report it. The ESET Protect console did not report anything for any of the workstations.

Link to comment
Share on other sites

If it helps at all, this is almost exactly the same issue:

 

Link to comment
Share on other sites

14 minutes ago, Marcos said:

Was a threat detected during the scan?

I just noticed, I made a very big mistake in the title of this thread. The workstations are shutting down, not rebooting. Is there a way to correct the title to not cause confusion?

Link to comment
Share on other sites

  • Marcos changed the title to ESET Endpoint Shutting Down After Scheduled Scan with 9.1.2051.0
2 minutes ago, Marcos said:

Please open a support ticket for further investigation.

Already done.

Link to comment
Share on other sites

We've updated a handful of Windows 10 machines with 9.1.2051 and it's been reported that users are being rebooted, but some of them are still on 9.0.2046 so I'm rather confused.

All the 9.1.2051 clients are in an error state saying they can't update "Failed to copy file" and reinstalling one of them says "Protection setup failed". 

Looks like my day is now ruined lol 

Raising a ticket, and hope someone in ESET can sort this one out. 

Link to comment
Share on other sites

  • ESET Moderators

Hello guys,

our technology and tech support teams are on it, we are investigating this with a priority.

We probably already identified the module version causing the issue.

 

We apologize for the inconvenience caused.

Peter

Link to comment
Share on other sites

1 minute ago, Peter Randziak said:

Hello guys,

our technology and tech support teams are on it, we are investigating this with a priority.

We probably already identified the module version causing the issue.

 

We apologize for the inconvenience caused.

Peter

Thanks for the response. Just as an update, we did revert back to 9.0.2046.0 and we had no shutdowns after the scan last night.

Should I expect a response here in the form or on my support ticket?

Link to comment
Share on other sites

14 minutes ago, Peter Randziak said:

Hello guys,

our technology and tech support teams are on it, we are investigating this with a priority.

We probably already identified the module version causing the issue.

 

We apologize for the inconvenience caused.

Peter

Thanks for taking the time to post.

Is this to resolve clients shutting down after scheduled scan, or would this also resolve the "failed to copy file" I'm seeing when modules are trying to update? 

 

Link to comment
Share on other sites

  • ESET Moderators

Hello @StooIT

2 minutes ago, StooIT said:

Is this to resolve clients shutting down after scheduled scan

Yes, exactly.

2 minutes ago, StooIT said:

or would this also resolve the "failed to copy file" I'm seeing when modules are trying to update?

This is a first report of such issue, I noticed so I would recommend to grab the logs and open a case with a support team to have it checked.

Peter

Link to comment
Share on other sites

  • Administrators
1 minute ago, StooIT said:

would this also resolve the "failed to copy file" I'm seeing when modules are trying to update?

This should be unrelated to the issue discussed in this topic. Please report it in a new topic and provide logs collected as follows (only ESET staff can access attachments):

Please carry on as follows:

  1. Enable advanced logging under Help and support -> Technical support
  2. Start logging with Procmon
  3. Reproduce the issue
  4. Stop logging
  5. Save the Procmon log and compress it.
  6. Collect logs with ESET Log Collector and upload both archives in the forum topic.

 

Link to comment
Share on other sites

44 minutes ago, Marcos said:

This should be unrelated to the issue discussed in this topic. Please report it in a new topic and provide logs collected as follows (only ESET staff can access attachments):

Please carry on as follows:

  1. Enable advanced logging under Help and support -> Technical support
  2. Start logging with Procmon
  3. Reproduce the issue
  4. Stop logging
  5. Save the Procmon log and compress it.
  6. Collect logs with ESET Log Collector and upload both archives in the forum topic.

 

Thanks Marcos, I'll send the files via email to my open ticket. I'll wait for them to get back to me. 

Link to comment
Share on other sites

Having the same issue with shutdown after scheduled scan.  Holding off on rolling this out until it is fixed.

Link to comment
Share on other sites

Having the same issue, i've opened a support ticket. Is there any solutions at this time?

Link to comment
Share on other sites

  • Administrators

We have a fixed module (Configuration module 2011.5) prepared which will be rolled out today to the pre-release channel. You can temporarily switch to the pre-release channel until the module is fully released next week, or you could manually copy it to the root folder "C:\Program Files\ESET\ESET Security\Modules" in safe mode (it will have to be removed from there when fully released).

Link to comment
Share on other sites

1 hour ago, Marcos said:

We have a fixed module (Configuration module 2011.5) prepared which will be rolled out today to the pre-release channel. You can temporarily switch to the pre-release channel until the module is fully released next week, or you could manually copy it to the root folder "C:\Program Files\ESET\ESET Security\Modules" in safe mode (it will have to be removed from there when fully released).

Great news, thanks Marcos :) 

Link to comment
Share on other sites

  • ESET Moderators

Hello guys,

Configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints

 

Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption.

 

Peter

Link to comment
Share on other sites

34 minutes ago, Peter Randziak said:

Hello guys,

Configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints

 

Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption.

 

Peter

For those of us who deploy via ESET Protect, and those of us who are little less experienced with ESET, does that mean we should expect a newer version (higher than 9.1.2051.0) to be available for deployment from ESET Protect at some point next week?

We'd prefer to stay on 9.0.2046.0 and wait for a full release rather than install a pre-release.

Link to comment
Share on other sites

  • ESET Moderators

Hello guys,

Configuration module 2011.5 is now available for

Endpoints v.9 (release update stream),

EP/ESMC/ERA servers (pre-release update stream)

EP/ESMC/ERA agents (release update stream)

Peter

Link to comment
Share on other sites

  • ESET Moderators

There are 3 scenarios / places where the issue might occur:

1. Edit of the policy in EP/ESMC/ERA

2. Merge of policies on EP/ESMC/ERA agent

3. Apply the policy on the Endpoint 

 

By the releases of Configuration module we covered #2 and #3.

 

#1 bas to be fixed manually in the management console, but to edit such policy, make sure Configuration module 2011.5 is used, for EP/ESMC/ERA it is available on pre-release update stream. Editing the policy by means of older Configuration module may damage it further.

 

Peter

Link to comment
Share on other sites

  • ESET Moderators
1 hour ago, GDI said:

For those of us who deploy via ESET Protect, and those of us who are little less experienced with ESET, does that mean we should expect a newer version (higher than 9.1.2051.0) to be available for deployment from ESET Protect at some point next week?

We'd prefer to stay on 9.0.2046.0 and wait for a full release rather than install a pre-release.

No the Configuration module is being updated as a module (like the Detection engine) so there won't be a service release of the endpoints to address it. The issue is in the mentioned module...

Peter

Link to comment
Share on other sites

Just now, Peter Randziak said:

No the Configuration module is being updated as a module (like the Detection engine) so there won't be a service release of the endpoints to address it. The issue is in the mentioned module...

Peter

Ok, so at this point it sounds like we can release 9.1.2051.0 as the issue has been resolved in the module (obviously as long as all systems have picked up the 2011.5 configuration module)

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...