ivessy85 0 Posted May 13 Share Posted May 13 Again - i am another with this same issue. EKRN crash causing the SENS service to hang for users. 2012r2 rdp server, 80gb ram, intermittently happens. might be time to get rid of the ESET product altogether if we cant get some action on this. Quote Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 15 Share Posted May 15 A fifth server 2012R2 had the problem today. When you log out the message is " Please wait for the system event notification service " Sorry for the message in another language the system was installed in French. Description Un problème a provoqué l’arrêt de l’interaction de ce programme avec Windows. Chemin d’accès de l’application défaillante : C:\Windows\explorer.exe Signature du problème Nom d’événement du problème : AppHangXProcB1 Nom de l’application: explorer.exe Version de l’application: 6.3.9600.18231 Horodatage de l’application: 56b8c9f1 Signature de blocage: 5fa0 Type de blocage: 134217856 Attente du nom de l’application: ekrn.exe Attente de la version de l’application: 0.0.0.0 Version du système: 6.3.9600.2.0.0.16.7 Identificateur de paramètres régionaux: 3084 Signature de blocage supplém. 1: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 2: c66b Signature de blocage supplém. 3: c66bc372ef269de9c7b52eae49af3b15 Signature de blocage supplém. 4: 5fa0 Signature de blocage supplém. 5: 5fa096dae1468101fb03e91bd7f6dfcc Signature de blocage supplém. 6: c66b Signature de blocage supplém. 7: c66bc372ef269de9c7b52eae49af3b15 Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,703 Posted May 15 Administrators Share Posted May 15 Do you happen to know for how long the server had been running before the issue occurred? Are you able to reproduce it relatively shortly after a restart? Quote Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 15 Share Posted May 15 The problem appeared randomly. I had the problem on 4 different servers. The fifth server that has the problem has been running for 10 days, it will be restarted tonight. I am unable to reproduce the problem. This server never has a problem is the first time. The servers that I have restarted have not yet had any problems. The problem only happened once on each server. Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,703 Posted May 15 Administrators Share Posted May 15 Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur. Quote Link to comment Share on other sites More sharing options...
tomosull 0 Posted May 15 Share Posted May 15 Hi Marcos, We've had it occur twice on a 2022 RDP server. Both occurred after 5-7 days uptime We've downgraded to v9 for the time being as the server is actively used Quote Link to comment Share on other sites More sharing options...
Martin_L 1 Posted May 16 Share Posted May 16 9 hours ago, Marcos said: Is there anybody who has experienced the issue more times on a server? Or it always happened just once on a particular server and never again after a reboot? The best would be if you have the system already configured for a manual crash and to generate complete memory dumps so that you could generate one should the issue occur. I have had it happening four times on the same server, uptime between the failures was 4-20 days. I have (hopefully) managed to set it up for a full memory dump when the problem occurs again. Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,703 Posted May 16 Administrators Share Posted May 16 Ok, if anybody can get a full dump from the frozen state, please let us know and supply it to us asap. We assure you that we treat the issue with highest possible priority, however, it's unfortunate that it can't be reproduced at any time or on our end by providing step-by-step instructions like it's in case of most other issues. As soon as we manage to get a dump, we'll analyze it and prepare a fix if the root cause is confirmed to be in ESET. On mission critical servers you can downgrade to Endpoint Security v9 that some of you have confirmed the issue hasn't re-emerged afterwards. Peter Randziak 1 Quote Link to comment Share on other sites More sharing options...
devlin 4 Posted May 17 Share Posted May 17 We were finally able to get memory dump. I hope it's complete. I'm sending you link via PM. Peter Randziak, Valerius, tomosull and 1 other 4 Quote Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 19 Share Posted May 19 For the first time I have a 2012R2 server which has the problem a second time. After 14 days of operation. Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,703 Posted May 23 Administrators Share Posted May 23 Allegedly disabling RDP protection resolves the issue according to one of the users. Will keep you posted. Martin_L 1 Quote Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 23 Share Posted May 23 The problem appeared a second time on another system. Before the second problem, Windows and Eset were up to date. Eset Version 10.0.12010.0 After restarting the server, Eset did a very long update. See screenshot. I find that when a Windows update is available the problem appears. Is it just a coincidence? Quote Link to comment Share on other sites More sharing options...
TomasB22 0 Posted May 25 Share Posted May 25 Hello all, I have also confirm this issue on four RDS terminal servers (Windows Server 2016, ESET Server Security 10.0.12010.0). Issue occured each 14 days regulary. I will need downgrade the ESET to 9.0.12017.0 version. Quote Link to comment Share on other sites More sharing options...
Pierre Belec 0 Posted May 25 Share Posted May 25 Hello Marcos, I disabled the RDP protocol and had the same problem. Quote Link to comment Share on other sites More sharing options...
TomasB22 0 Posted Friday at 06:32 AM Share Posted Friday at 06:32 AM @Pierre Belec - Does the issue still persists on ESET Server Security 10.0.12010.0 with RDP Intrusion Detection feature disabled? Quote Link to comment Share on other sites More sharing options...
devlin 4 Posted Friday at 11:59 AM Share Posted Friday at 11:59 AM @TomasB22 Yes, issue persist. This fix is not working for us. @Marcos Thanks for the tip Marcos, but unfortunatelly it's not working for us. We had to roll back to v9 and can't experiment anymore. People are really anoyed by this issue. What about memory dump I have provided? Is it ok? Quote Link to comment Share on other sites More sharing options...
MaciejPL 0 Posted Saturday at 06:06 AM Share Posted Saturday at 06:06 AM Quote We have the same issue on couple of RDP/Terminal servers. We will be testing suggested "RDP switch" and downgrade from 10-9 with different combinations to see results. Quote Link to comment Share on other sites More sharing options...
Martin_L 1 Posted 19 hours ago Share Posted 19 hours ago I can confirm that turning off RDP protection did not resolve the problem. On the bright side I was able to pull a complete memory dump (30GB) from an affected server, fingers crossed this one contains the data needed for a solution. Valerius 1 Quote Link to comment Share on other sites More sharing options...
kapela86 9 Posted 18 hours ago Share Posted 18 hours ago For now I restart our RDP servers every sunday when no one is working. No problems so far. Quote Link to comment Share on other sites More sharing options...
Administrators Marcos 4,703 Posted 13 hours ago Administrators Share Posted 13 hours ago We have pinpointed the issue. It will be addressed in a hotfix that is being prepared and should be available soon. Thank you for co-operation on this matter. Valerius, Martin_L and devlin 3 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.