Jump to content

Problems on Windows 2012 R2 RDP

Thomas Fincke
 Share

Recommended Posts

  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted

The issue would occur if the catalog gets corrupt for whatever reason. Please check C:\Windows\System32\catroot2\dberr.txt if it contains some recent catalog errors.

Link to comment
Share on other sites
EranBix

EranBix 0

Posted
Posted

We are facing the same problem at Windows Serwer 2012 r2 and Windows Serwer 2016 and Windows Serwer 2019 with Remote Destkop Licences after updating Eset to ver 10.

At some servers we downgrade to version 9

-----------------------------

To people with Eset Version 10

Solution to restart server is:

sc queryex sens
taskkill /PID XXXX /f

then You can do restart not hard restart server.
U can also start this service (sens) without restart but serwer will have still problems.

 

Link to comment
Share on other sites
  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted
5 hours ago, EranBix said:

We are facing the same problem at Windows Serwer 2012 r2 and Windows Serwer 2016 and Windows Serwer 2019 with Remote Destkop Licences after updating Eset to ver 10.

Please create a new topic and describe the issue in detail. The issue being discussed in this topic is about ekrn.exe not starting with Windows at times, however, v10 is not affected since it has certain Microsoft dlls signed by ESET to prevent long verification on system startup.

Link to comment
Share on other sites
Thomas Fincke

Thomas Fincke 0

Posted
  • Author
Posted
1 hour ago, Marcos said:

Please create a new topic and describe the issue in detail. The issue being discussed in this topic is about ekrn.exe not starting with Windows at times, however, v10 is not affected since it has certain Microsoft dlls signed by ESET to prevent long verification on system startup.

@ Marcos:
that is not correct.
We have the problems with version 10.
And we don't have problems at start-up, but during use.
So this is probably another case and it could be a bigger problem at ESET.

Link to comment
Share on other sites
Dante_sch

Dante_sch 0

Posted
Posted (edited)

Same problem!

Server 2012 r2 with RDS and ESET V10.0.12010.0

ekrn.exe causes windows logon application to hang. Users unable to logoff, get message "Please wait for the system event notification service". Have to restart server to resolve temporarily. Also causes issues with windows explorer and taskbar.

I will try to downgrade to v9 and see if it resolves the issue for us. 

 

Edited by Dante_sch
Link to comment
Share on other sites
Jarvick Castillo

Jarvick Castillo 0

Posted
Posted

Hi we have de message in C:\Windows\System32\catroot2\dberr.txt

CatalogDB: 11:57:59 AM 4/25/2023: Init:: Database previously shutdown dirty  C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb

How can repair this?

Link to comment
Share on other sites
EranBix

EranBix 0

Posted
Posted

 

@ Marcos

First post

The servers are then relatively difficult to operate and the message appears when logging off:
Please wait for "Notification text for system events".

As I am reading this topic all ppl write about this problem...

 

Link to comment
Share on other sites
  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted
20 minutes ago, EranBix said:

First post

The servers are then relatively difficult to operate and the message appears when logging off:
Please wait for "Notification text for system events".

Isn't it possible to manually trigger a crash and generate a complete memory dump at this point as per https://support.eset.com/en/kb380?

Link to comment
Share on other sites
devlin

devlin 5

Posted
Posted
6 hours ago, EranBix said:

 

@ Marcos

First post

The servers are then relatively difficult to operate and the message appears when logging off:
Please wait for "Notification text for system events".

As I am reading this topic all ppl write about this problem...

 

 

Yes, I think so too.

We are experiencing the same problem on WS 2012 R2 and WS 2019. Both RDS.

And unfortunately we are not aware how to manually trigger a crash.

 

Link to comment
Share on other sites
  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted
Just now, devlin said:

And unfortunately we are not aware how to manually trigger a crash.

Please refer to https://support.eset.com/en/kb380 for instructions.

We've heard that switching to the pre-release update channel in the advanced setup reportedly fixes the issue. However, this has not been 100% confirmed yet and the issue as well as the root cause is being investigated. We're currently waiting for memory dumps to analyze them.

Link to comment
Share on other sites
  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted
4 hours ago, Jarvick Castillo said:

Doesn´t Work This, stills occurrs few times yet.

We'll need a complete memory dump from time when the issue occurs in order to determine the root cause.

Link to comment
Share on other sites
2spiK

2spiK 0

Posted
Posted

Same here... 

 

Windows notifications services stuck on RDS session opening :( 

Windows Server 2019 affected.. 

We are thinking of uninstalling ESET and leaving Windows Defender until our dear editor patches the product 

Link to comment
Share on other sites
Martin_L

Martin_L 2

Posted
Posted

Has anyone managed to resolve this? I have the same problem with one of my customers. Windows Server 2016 with RDS role, ESET Server Security 10.0.12010.0. It will run fine for a few days, maybe a week, then sessions start getting blocked with the "waiting for SENS" message.

I will try to get a complete memory dump the next time it occurs.

Link to comment
Share on other sites
  • ESET Moderators
Peter Randziak

Peter Randziak 1,152

Posted
  • ESET Moderators
Posted

Hello @2spiK and @Martin_L,

the development team needs a complete memory dump from such state to analyze the issue.
Once you have it, please pack it, upload to a safe location and send the download details to me and @Marcos over a private message

Peter
(note for us: P_EFSW-2430)

Link to comment
Share on other sites
Andy C

Andy C 0

Posted
Posted

I'm just troubleshooting this for the second time in 3 weeks. We resolved the first instance of this on our 2019 RDS server by uninstalling KB5023702. We've now got the same issue after installing KB5025229. This server has ESET Server Security 10.0.12010.0.

I'm working through the issue at present.

Andy

Link to comment
Share on other sites
  • ESET Moderators
Peter Randziak

Peter Randziak 1,152

Posted
  • ESET Moderators
Posted

Hello @Andy C,

sorry to hear that you experienced the issue again.
Can you please provide us with a complete memory dump from the server in such state so our development team can investigate it?

Once you have it, please pack it, upload to a safe location and send the download details to me and @Marcos over a private message.

Thank you, Peter

Link to comment
Share on other sites
Joel V

Joel V 2

Posted
Posted

We have now experienced this issue in the last ~3 weeks on a range of different virtual servers (Hyper-V 2012 R2, 2016 and 2019), running on different hardware. There is no common thread apart from the fact we recently upgraded all our server antivirus versions to ESET Server Security 10.

What happens is that the server becomes unresponsive, a lot of programs refuse to open and when you try to restart the server, it will just hang with the message "waiting for system event notification service to close".

This needs *urgent* attention.

 

Link to comment
Share on other sites
  • Administrators
Marcos

Marcos 5,189

Posted
  • Administrators
Posted
31 minutes ago, Joel V said:

This needs *urgent* attention.

We indeed treat this with high priority, however, we need a complete memory dump from you for investigation and to determine the root cause.

Link to comment
Share on other sites
kapela86

kapela86 10

Posted
Posted

I've experienced this problem some time ago. Server 2016 with RDS role & Eset 10.0.12010.0. Users suddenly couldn't copy files to/from remote desktop and when they tried logging out it stayed stuck at waiting for System Event Notification Service to shut down. I tried restarting the server and it coudn't shut down so I had to reset it (powercycle), after that it was working ok and I didn't investigate it . And now today it happened again and after reset I did some checking and found out many entries in event viewer that explorer.exe was not responding because of ekrn.exe. After that I looked here and found this topic. I don't have any memory dumps etc (and even If I did, that VM has 90GB of ram). I can only provide you with this. 

Pakiet błędów 2194417022129290342, typ 5
Nazwa zdarzenia: AppHangXProcB1
Odpowiedź: Niedostępny
Identyfikator pliku Cab: 0

Sygnatura problemu:
P1: explorer.exe
P2: 10.0.14393.5648
P3: 63b792d6
P4: d642
P5: 134217856
P6: ekrn.exe
P7: 0.0.0.0
P8: 
P9: 
P10: 

Dołączone pliki: 

Te pliki mogą być dostępne tutaj:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_explorer.exe_c3235ec849cb1bb83f36349d51f02ab2c0f54ee7_2bda4280_c73c947d

Symbol analizy: 
Ponowne sprawdzanie rozwiązania: 0
Identyfikator raportu: 8749a4a8-effa-11ed-85a1-00155d01dd07
Stan raportu: 0
Skrócony pakiet: f031ea1e2ec292664e7422a7b5163c66

 

Link to comment
Share on other sites
Pierre Belec

Pierre Belec 0

Posted
Posted

I had the same problem with 4 Windows 2012R2 servers.

I noticed that when I get a notification from the server that some updates are ready to install, the problem appears.

After restarting the server, Windows applies the new updates and Eset too.

So far the servers seem fine.

If that can help.

 

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...