schuetzdentalCB 8 Posted June 30, 2022 Posted June 30, 2022 hi rolled out the latest eset endpoint security update on my clients and did NOT clicked on "reboot automaticly" ... update was installed this morning and now suddenly and completely randomly this just reboots the systems without asking.. no waiting, no notification. wtf is this? i remember from some older update that this happend already...cant believe this . really...
Administrators Marcos 5,443 Posted June 30, 2022 Administrators Posted June 30, 2022 Couldn't it be that you have a software install task assigned to a dynamic group? The thing is that automatic program updates (so-called uPCU) are applied ONLY after a computer restart which is initiated by the user, not by the AV program. Even then the machine is restarted automatically only if you allowed it in the task:
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 nope it was just the update task without "allow reboot option" never made problems it always waited until manual reboot...and as i can see the systems were shut down (not rebooted)
Administrators Marcos 5,443 Posted June 30, 2022 Administrators Posted June 30, 2022 Please clarify the following: 1, In the title you stated that the machines rebooted after upgrade (with a delay of a couple of hours?), however, later you stated that the machines were shut down automatically. I assume that the title is incorrect then, is it? 2, You've mentioned running an update task. Do you mean that you clicked this option from the menu? If you, you received the following confirmation dialog in which a computer reboot is enabled by default. Are you positive that you unchecked the box?
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 "reboot" is wrong, yes.. excatly i unchecked the checkbox in ur last pic. the systems are shutting down...they are not rebooting
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 i mean i rolled out this update this morning an the systems where already shown as "reboot needed" in esmc but this shutdown thing happened hours later.. so this should make clear i definitely unchecked the reboot checkbox.
Rob Schember 3 Posted June 30, 2022 Posted June 30, 2022 (edited) I can confirm we're having the exact same problem here since the upgrade to 9.1.2051.0. It seems to be triggered by a module update as both times I noticed it happen, I saw the program was running a startup scan, which happens immediately after a module update. Twice so far, I was shown an ESET window stating my computer was going to be shut down and to save my work. The window had a 30 second countdown timer. I was able to click the "Cancel shutdown" option once, but the second time I didn't see the window in time to react, so my computer was shut down. This has never once happened before the update to 9.1.2051.0 and we've been using ESET for 10+ years. Edited June 30, 2022 by Rob Schember Additional details
Administrators Marcos 5,443 Posted June 30, 2022 Administrators Posted June 30, 2022 Could you please confirm or deny that you have a scan task scheduled?
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 nope. no scan tasks scheduled. i will also check windows eventlogs, maybe i can provide more information.
StooIT 5 Posted June 30, 2022 Posted June 30, 2022 (edited) Having the same issue on 9.0.2046 clients but only those connected to the ESET Protect Server (we run two different ESET Protect Servers) that's rolled out 9.1.2051 to some clients (and those updated clients are now broken, and now cannot update. 9.0.2046 clients are shutting down after the scheduled scan finishes, and the policies are set to "Do nothing" after a scan. Edited June 30, 2022 by StooIT clarification
Rob Schember 3 Posted June 30, 2022 Posted June 30, 2022 7 minutes ago, Marcos said: Could you please confirm or deny that you have a scan task scheduled? I do have a scheduled scan task set for 7pm on Wednesday nights, and when I came in this morning, ALL of my computers were shut down, even though the scan task is set to "No Action". However, this is a different issue, so there appears to be multiple issues with shut downs happening here. This started happening before the scheduled scan ever would've triggered at 7pm. After a module update, the computers show a window with a 30 second timeout to shut down the computer! Another user posted the window I'm talking about. See the attachment here. However, in my case, instead of "Device restart", I believe it said "Device shut down".
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 found something in the eventlogs. for me it looks exactly like the last problem after an eset update where it just shutdown/rebooted even if you uncheck the automatic reboot checkbox. (there should be a thread about this here also somewhere).
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 2 minutes ago, Rob Schember said: I do have a scheduled scan task set for 7pm on Wednesday nights, and when I came in this morning, ALL of my computers were shut down, even though the scan task is set to "No Action". However, this is a different issue, so there appears to be multiple issues with shut downs happening here. This started happening before the scheduled scan ever would've triggered at 7pm. After a module update, the computers show a window with a 30 second timeout to shut down the computer! Another user posted the window I'm talking about. See the attachment here. However, in my case, instead of "Device restart", I believe it said "Device shut down". i'm running eset on all clients in silent mode. this message wont be visible for my users. - only on my pc its in full mode but this didn't show. but nice try eset gui ^^
schuetzdentalCB 8 Posted June 30, 2022 Author Posted June 30, 2022 24 minutes ago, Marcos said: Could you please confirm or deny that you have a scan task scheduled? sorry i thought you mean client-tasks in esmc. i indeed have scheduled task scanning clients at 12:00 o'Clock for malware with "do nothing" after finish. i removed this task now...i think this shutdown is triggered by this? but again im pretty sure we had that problem a year before in one of esets updates...cant find the thread btw.
ESET Moderators Peter Randziak 1,181 Posted June 30, 2022 ESET Moderators Posted June 30, 2022 Hello guys, our technology and tech support teams are on it, we are investigating this with a priority. We probably already identified the module version causing the issue. We apologize for the inconvenience caused. Peter Trooper and StooIT 2
Administrators Marcos 5,443 Posted June 30, 2022 Administrators Posted June 30, 2022 We believe that we have nailed it down to the Configuration Engine 2011.4 that has been distributed to a couple of hundreds of ESET PROTECT users since yesterday so far. What is weird is that the module had been available for millions of Endpoint users without any such issue reported. We are working on it hard to figure out the cause and to bring a fix as soon as possible. We apologize for the inconvenience. StooIT, Peter Randziak, Trooper and 1 other 4
Administrators Marcos 5,443 Posted June 30, 2022 Administrators Posted June 30, 2022 One more question - have you edited a policy applied to troublesome clients in ESET PROTECT since yesterday?
StooIT 5 Posted June 30, 2022 Posted June 30, 2022 Just to add to this one. Updated 8 clients to 2051 - these all now error with "failed to copy file" when attempting to do module updates. On 1 of the clients, I removed ESET (using the removal tool) and reinstalled 2051, this fails to start ESET with "Product setup failed", and also cannot do module updates. It's stuck waiting to perform it's first scan, as the module update cannot complete. In the network where these 8 clients were updated to 2051, the remaining clients on 2046 started to shutdown after the scheduled scan finished (scan set to start at 10:30am, shutdowns started shortly after this time). The scan policies on all clients are set to "no action" and shouldn't shutdown. I can only suspect that by updating some clients to 2051 has also made changes to the underlying policies on Protect Server, and now ignore the "do nothing" option in the scheduled scan, and forces a shutdown and older client versions as well. I've raised a ticket (00388505) in the hope both the modules not updating with "Failed to copy file" and the shutting down after scheduled scans can be investigated/fixed asap. I've had to disable all scheduled scans in the domain (across two Protect Servers) as a precaution.
ESET Moderators Peter Randziak 1,181 Posted July 1, 2022 ESET Moderators Posted July 1, 2022 Hello guys, Fixed configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption. Peter Trooper 1
ESET Insiders Trooper 68 Posted July 1, 2022 ESET Insiders Posted July 1, 2022 8 hours ago, Peter Randziak said: Hello guys, Fixed configuration module 2011.5 is now available on pre-release update stream for EP/ESMC/ERA management agents and Endpoints Reverting update to Configuration module 1998.2 has been released for EP/ESMC/ERA servers (on release update stream, since ~ 11:25 CEST) in order to prevent further policies corruption. Peter I am on ESET PROTECT Cloud. Do I need to take any action on this @Peter Randziak?
ESET Moderators Peter Randziak 1,181 Posted July 4, 2022 ESET Moderators Posted July 4, 2022 Hello @Trooper On 7/1/2022 at 9:47 PM, Trooper said: I am on ESET PROTECT Cloud. Do I need to take any action on this @Peter Randziak? ESET PROTECT Cloud hasn't used the affected Configuration module, so #1 from the list is not applicable https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054 #2 and #3 from the list should be resolved automatically with the fixed Configuration module so based on my current knowledge of the issue, you do not need to take any action. Peter Trooper 1
ESET Insiders Trooper 68 Posted July 6, 2022 ESET Insiders Posted July 6, 2022 On 7/4/2022 at 2:40 AM, Peter Randziak said: Hello @Trooper ESET PROTECT Cloud hasn't used the affected Configuration module, so #1 from the list is not applicable https://forum.eset.com/topic/32875-eset-endpoint-shutting-down-after-scheduled-scan-with-9120510/?do=findComment&comment=153054 #2 and #3 from the list should be resolved automatically with the fixed Configuration module so based on my current knowledge of the issue, you do not need to take any action. Peter Thanks Peter I appreciate it. Peter Randziak 1
Recommended Posts