latest endpoint security reboots itself after update...again!!

[schuetzdentalCB 8]

hi

rolled out the latest eset endpoint security update on my clients and did NOT clicked on "reboot automaticly" ... update was installed this morning and now suddenly and completely randomly this just reboots the systems without asking.. no waiting, no notification. wtf is this? i remember from some older update that this happend already...cant believe this . really...

[Marcos 5,070]

Couldn't it be that you have a software install task assigned to a dynamic group? The thing is that automatic program updates (so-called uPCU) are applied ONLY after a computer restart which is initiated by the user, not by the AV program.

Even then the machine is restarted automatically only if you allowed it in the task:

[schuetzdentalCB 8]

nope it was just the update task without "allow reboot option" never made problems it always waited until manual reboot...and as i can see the systems were shut down (not rebooted) 

[Marcos 5,070]

Please clarify the following:
1, In the title you stated that the machines rebooted after upgrade (with a delay of a couple of hours?), however, later you stated that the machines were shut down automatically. I assume that the title is incorrect then, is it?
2, You've mentioned running an update task. Do you mean that you clicked this option from the menu?

If you, you received the following confirmation dialog in which a computer reboot is enabled by default. Are you positive that you unchecked the box?

[schuetzdentalCB 8]

"reboot" is wrong, yes.. 

excatly i unchecked the checkbox in ur last pic. the systems are shutting down...they are not rebooting

[schuetzdentalCB 8]

i mean i rolled out this update this morning an the systems where already shown as "reboot needed" in esmc but this shutdown thing happened hours later.. so this should make clear i definitely unchecked the reboot checkbox.

[Rob Schember 2]

I can confirm we're having the exact same problem here since the upgrade to 9.1.2051.0. It seems to be triggered by a module update as both times I noticed it happen, I saw the program was running a startup scan, which happens immediately after a module update.

Twice so far, I was shown an ESET window stating my computer was going to be shut down and to save my work. The window had a 30 second countdown timer. I was able to click the "Cancel shutdown" option once, but the second time I didn't see the window in time to react, so my computer was shut down.

This has never once happened before the update to 9.1.2051.0 and we've been using ESET for 10+ years.

Edited June 30, 2022 by Rob Schember
Additional details

[Marcos 5,070]

Could you please confirm or deny that you have a scan task scheduled?

[schuetzdentalCB 8]

nope. no scan tasks scheduled. i will also check windows eventlogs, maybe i can provide more information.

[StooIT 5]

Having the same issue on 9.0.2046 clients but only those connected to the ESET Protect Server (we run two different ESET Protect Servers) that's rolled out 9.1.2051 to some clients (and those updated clients are now broken, and now cannot update.

9.0.2046 clients are shutting down after the scheduled scan finishes, and the policies are set to "Do nothing" after a scan. 

 

Edited June 30, 2022 by StooIT
clarification

[Rob Schember 2]

7 minutes ago, Marcos said:

Could you please confirm or deny that you have a scan task scheduled?

I do have a scheduled scan task set for 7pm on Wednesday nights, and when I came in this morning, ALL of my computers were shut down, even though the scan task is set to "No Action".

However, this is a different issue, so there appears to be multiple issues with shut downs happening here. This started happening before the scheduled scan ever would've triggered at 7pm. After a module update, the computers show a window with a 30 second timeout to shut down the computer!

Another user posted the window I'm talking about. See the attachment here. However, in my case, instead of "Device restart", I believe it said "Device shut down".

[schuetzdentalCB 8]

found something in the eventlogs.

for me it looks exactly like the last problem after an eset update where it just shutdown/rebooted even if you uncheck the automatic reboot checkbox. (there should be a thread about this here also somewhere).

[schuetzdentalCB 8]

2 minutes ago, Rob Schember said:

I do have a scheduled scan task set for 7pm on Wednesday nights, and when I came in this morning, ALL of my computers were shut down, even though the scan task is set to "No Action".

However, this is a different issue, so there appears to be multiple issues with shut downs happening here. This started happening before the scheduled scan ever would've triggered at 7pm. After a module update, the computers show a window with a 30 second timeout to shut down the computer!

Another user posted the window I'm talking about. See the attachment here. However, in my case, instead of "Device restart", I believe it said "Device shut down".

i'm running eset on all clients in silent mode. this message wont be visible for my users. - only on my pc its in full mode but this didn't show. but nice try eset gui ^^

[schuetzdentalCB 8]

24 minutes ago, Marcos said:

Could you please confirm or deny that you have a scan task scheduled?

sorry i thought you mean client-tasks in esmc. i indeed have scheduled task scanning clients at 12:00 o'Clock for malware with "do nothing" after finish. i removed this task now...i think this shutdown is triggered by this? but again im pretty sure we had that problem a year before in one of esets updates...cant find the thread btw.

[Peter Randziak 1,130]

Hello guys,

our technology and tech support teams are on it, we are investigating this with a priority.

We probably already identified the module version causing the issue.

 

We apologize for the inconvenience caused.

Peter

[Marcos 5,070]

We believe that we have nailed it down to the Configuration Engine 2011.4 that has been distributed to a couple of hundreds of ESET PROTECT users since yesterday so far. What is weird is that the module had been available for millions of Endpoint users without any such issue reported. We are working on it hard to figure out the cause and to bring a fix as soon as possible. We apologize for the inconvenience.

[Marcos 5,070]

One more question - have you edited a policy applied to troublesome clients in ESET PROTECT since yesterday?

[StooIT 5]

Just to add to this one. 

Updated 8 clients to 2051 - these all now error with "failed to copy file" when attempting to do module updates.

On 1 of the clients, I removed ESET (using the removal tool) and reinstalled 2051, this fails to start ESET with "Product setup failed", and also cannot do module updates. It's stuck waiting to perform it's first scan, as the module update cannot complete. 

In the network where these 8 clients were updated to 2051, the remaining clients on 2046 started to shutdown after the scheduled scan finished (scan set to start at 10:30am, shutdowns started shortly after this time). The scan policies on all clients are set to "no action" and shouldn't shutdown.

I can only suspect that by updating some clients to 2051 has also made changes to the underlying policies on Protect Server, and now ignore the "do nothing" option in the scheduled scan, and forces a shutdown and older client versions as well.

I've raised a ticket (00388505) in the hope both the modules not updating with "Failed to copy file" and the shutting down after scheduled scans can be investigated/fixed asap. 

I've had to disable all scheduled scans in the domain (across two Protect Servers) as a precaution. 

[Peter Randziak 1,130]

Hello guys,

Fixed configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints

Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption.

 

Peter

[Trooper 65]

8 hours ago, Peter Randziak said:

Hello guys,

Fixed configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints

Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption.

 

Peter

I am on ESET PROTECT Cloud.  Do I need to take any action on this @Peter Randziak?

[Peter Randziak 1,130]

Hello @Trooper

On 7/1/2022 at 9:47 PM, Trooper said:

I am on ESET PROTECT Cloud.  Do I need to take any action on this @Peter Randziak?

ESET PROTECT Cloud hasn't used the affected Configuration module, so #1 from the list is not applicable 

https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054

#2 and #3 from the list should be resolved automatically with the fixed Configuration module so based on my current knowledge of the issue, you do not need to take any action.

 

Peter 

[Trooper 65]

On 7/4/2022 at 2:40 AM, Peter Randziak said:

Hello @Trooper

ESET PROTECT Cloud hasn't used the affected Configuration module, so #1 from the list is not applicable 

https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054

#2 and #3 from the list should be resolved automatically with the fixed Configuration module so based on my current knowledge of the issue, you do not need to take any action.

 

Peter 

 

Thanks Peter I appreciate it.