GDI 3 Posted June 29, 2022 Share Posted June 29, 2022 (edited) I did open a support ticket for this but posting to see if anyone else is experiencing the same issue. We manage all of our workstations with ESET Protect. We deployed 9.1.2051.0 yesterday. We have a policy setup to run a nightly scheduled scan with "No Action" after it's complete. We observed every single workstation reboot (during work hours) after the scan was complete. I was actually logged into a system when it happened. Every single workstation had an Event 1074 in the Windows event logs stating that C:\Program Files\ESET\ESET Security\ekrn.exe initiated a shutdown. I know we could probably just disable the nightly scan but can't due to compliance reasons. We downgraded to 9.0.2046.0 on all systems. But, anyone else experiencing this? Edited June 29, 2022 by Marcos Title amended Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted June 29, 2022 Administrators Share Posted June 29, 2022 Was a threat detected during the scan? Link to comment Share on other sites More sharing options...
GDI 3 Posted June 29, 2022 Author Share Posted June 29, 2022 Just now, Marcos said: Was a threat detected during the scan? Not that I'm aware of. If there was, it didn't report it. The ESET Protect console did not report anything for any of the workstations. Link to comment Share on other sites More sharing options...
GDI 3 Posted June 29, 2022 Author Share Posted June 29, 2022 If it helps at all, this is almost exactly the same issue: Link to comment Share on other sites More sharing options...
GDI 3 Posted June 29, 2022 Author Share Posted June 29, 2022 14 minutes ago, Marcos said: Was a threat detected during the scan? I just noticed, I made a very big mistake in the title of this thread. The workstations are shutting down, not rebooting. Is there a way to correct the title to not cause confusion? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted June 29, 2022 Administrators Share Posted June 29, 2022 Please open a support ticket for further investigation. Link to comment Share on other sites More sharing options...
GDI 3 Posted June 29, 2022 Author Share Posted June 29, 2022 2 minutes ago, Marcos said: Please open a support ticket for further investigation. Already done. Link to comment Share on other sites More sharing options...
StooIT 5 Posted June 30, 2022 Share Posted June 30, 2022 We've updated a handful of Windows 10 machines with 9.1.2051 and it's been reported that users are being rebooted, but some of them are still on 9.0.2046 so I'm rather confused. All the 9.1.2051 clients are in an error state saying they can't update "Failed to copy file" and reinstalling one of them says "Protection setup failed". Looks like my day is now ruined lol Raising a ticket, and hope someone in ESET can sort this one out. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 30, 2022 ESET Moderators Share Posted June 30, 2022 Hello guys, our technology and tech support teams are on it, we are investigating this with a priority. We probably already identified the module version causing the issue. We apologize for the inconvenience caused. Peter Trooper 1 Link to comment Share on other sites More sharing options...
GDI 3 Posted June 30, 2022 Author Share Posted June 30, 2022 1 minute ago, Peter Randziak said: Hello guys, our technology and tech support teams are on it, we are investigating this with a priority. We probably already identified the module version causing the issue. We apologize for the inconvenience caused. Peter Thanks for the response. Just as an update, we did revert back to 9.0.2046.0 and we had no shutdowns after the scan last night. Should I expect a response here in the form or on my support ticket? Peter Randziak 1 Link to comment Share on other sites More sharing options...
StooIT 5 Posted June 30, 2022 Share Posted June 30, 2022 14 minutes ago, Peter Randziak said: Hello guys, our technology and tech support teams are on it, we are investigating this with a priority. We probably already identified the module version causing the issue. We apologize for the inconvenience caused. Peter Thanks for taking the time to post. Is this to resolve clients shutting down after scheduled scan, or would this also resolve the "failed to copy file" I'm seeing when modules are trying to update? Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted June 30, 2022 ESET Moderators Share Posted June 30, 2022 Hello @StooIT 2 minutes ago, StooIT said: Is this to resolve clients shutting down after scheduled scan Yes, exactly. 2 minutes ago, StooIT said: or would this also resolve the "failed to copy file" I'm seeing when modules are trying to update? This is a first report of such issue, I noticed so I would recommend to grab the logs and open a case with a support team to have it checked. Peter Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted June 30, 2022 Administrators Share Posted June 30, 2022 1 minute ago, StooIT said: would this also resolve the "failed to copy file" I'm seeing when modules are trying to update? This should be unrelated to the issue discussed in this topic. Please report it in a new topic and provide logs collected as follows (only ESET staff can access attachments): Please carry on as follows: Enable advanced logging under Help and support -> Technical support Start logging with Procmon Reproduce the issue Stop logging Save the Procmon log and compress it. Collect logs with ESET Log Collector and upload both archives in the forum topic. StooIT 1 Link to comment Share on other sites More sharing options...
StooIT 5 Posted June 30, 2022 Share Posted June 30, 2022 I've already raised the "Failed to copy files" under ticket 00388505, so will wait to hear back from that. 👍 Peter Randziak 1 Link to comment Share on other sites More sharing options...
StooIT 5 Posted June 30, 2022 Share Posted June 30, 2022 44 minutes ago, Marcos said: This should be unrelated to the issue discussed in this topic. Please report it in a new topic and provide logs collected as follows (only ESET staff can access attachments): Please carry on as follows: Enable advanced logging under Help and support -> Technical support Start logging with Procmon Reproduce the issue Stop logging Save the Procmon log and compress it. Collect logs with ESET Log Collector and upload both archives in the forum topic. Thanks Marcos, I'll send the files via email to my open ticket. I'll wait for them to get back to me. Link to comment Share on other sites More sharing options...
ESET Insiders Trooper 65 Posted June 30, 2022 ESET Insiders Share Posted June 30, 2022 Having the same issue with shutdown after scheduled scan. Holding off on rolling this out until it is fixed. Link to comment Share on other sites More sharing options...
IBC 0 Posted July 1, 2022 Share Posted July 1, 2022 Having the same issue, i've opened a support ticket. Is there any solutions at this time? Link to comment Share on other sites More sharing options...
Administrators Marcos 5,074 Posted July 1, 2022 Administrators Share Posted July 1, 2022 We have a fixed module (Configuration module 2011.5) prepared which will be rolled out today to the pre-release channel. You can temporarily switch to the pre-release channel until the module is fully released next week, or you could manually copy it to the root folder "C:\Program Files\ESET\ESET Security\Modules" in safe mode (it will have to be removed from there when fully released). StooIT 1 Link to comment Share on other sites More sharing options...
StooIT 5 Posted July 1, 2022 Share Posted July 1, 2022 1 hour ago, Marcos said: We have a fixed module (Configuration module 2011.5) prepared which will be rolled out today to the pre-release channel. You can temporarily switch to the pre-release channel until the module is fully released next week, or you could manually copy it to the root folder "C:\Program Files\ESET\ESET Security\Modules" in safe mode (it will have to be removed from there when fully released). Great news, thanks Marcos Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 1, 2022 ESET Moderators Share Posted July 1, 2022 Hello guys, Configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption. Peter Link to comment Share on other sites More sharing options...
GDI 3 Posted July 1, 2022 Author Share Posted July 1, 2022 34 minutes ago, Peter Randziak said: Hello guys, Configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption. Peter For those of us who deploy via ESET Protect, and those of us who are little less experienced with ESET, does that mean we should expect a newer version (higher than 9.1.2051.0) to be available for deployment from ESET Protect at some point next week? We'd prefer to stay on 9.0.2046.0 and wait for a full release rather than install a pre-release. Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 1, 2022 ESET Moderators Share Posted July 1, 2022 Hello guys, Configuration module 2011.5 is now available for Endpoints v.9 (release update stream), EP/ESMC/ERA servers (pre-release update stream) EP/ESMC/ERA agents (release update stream) Peter Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 1, 2022 ESET Moderators Share Posted July 1, 2022 There are 3 scenarios / places where the issue might occur: 1. Edit of the policy in EP/ESMC/ERA 2. Merge of policies on EP/ESMC/ERA agent 3. Apply the policy on the Endpoint By the releases of Configuration module we covered #2 and #3. #1 bas to be fixed manually in the management console, but to edit such policy, make sure Configuration module 2011.5 is used, for EP/ESMC/ERA it is available on pre-release update stream. Editing the policy by means of older Configuration module may damage it further. Peter Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 1, 2022 ESET Moderators Share Posted July 1, 2022 1 hour ago, GDI said: For those of us who deploy via ESET Protect, and those of us who are little less experienced with ESET, does that mean we should expect a newer version (higher than 9.1.2051.0) to be available for deployment from ESET Protect at some point next week? We'd prefer to stay on 9.0.2046.0 and wait for a full release rather than install a pre-release. No the Configuration module is being updated as a module (like the Detection engine) so there won't be a service release of the endpoints to address it. The issue is in the mentioned module... Peter Link to comment Share on other sites More sharing options...
GDI 3 Posted July 1, 2022 Author Share Posted July 1, 2022 Just now, Peter Randziak said: No the Configuration module is being updated as a module (like the Detection engine) so there won't be a service release of the endpoints to address it. The issue is in the mentioned module... Peter Ok, so at this point it sounds like we can release 9.1.2051.0 as the issue has been resolved in the module (obviously as long as all systems have picked up the 2011.5 configuration module) Link to comment Share on other sites More sharing options...
Recommended Posts