ESET Management Agent doesnt start - Unable to load Loader

[Timme91 0]

Hello everyone, 

the service "Eset Management Agent" has not startet for a few days now.

This means that the clients cannot connect to the "ESET Security Management Center".

It affects almost all of our Windows-10 computers. (around 150)

When I try to start the service manually, the Windows-Clients shows: "ESET Management Agent on local computer failed to start. For more information, see the system event log. Contact the service manufacturer. Refer to service specific error code 70" 

The trace.log  contains following:  

2023-12-14 10:41:17 Information: [Thread 690]: Loading ESET modules from C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\
2023-12-14 10:41:17 Error: Service [Thread 690]: ModuleManager: Unable to load Loader.

Windows event viewer:

The ESET Management Service service stopped with the following service-specific error. The remote server has stopped or is currently shutting down.

Versions:

ESET Management Agent 7.2.1266.0

ESET Endpoint Antivirus 10.1.2050.0

Does anyone know this problem or know a few possible solutions?

Thank you very much.

Best regards Timme

 

 

[Marcos 5,074]

Do you have ESET Security Management Center 7.2 installed? If so, it reached EOL in Dec 2022: https://support-eol.eset.com/en/policy_business/product_tables.html.

The latest version is ESET PROTECT 11.0.503.

[Timme91 0]

Hi Marcos,

thanks for your answer.

After a reinstallating the "ESET Management Agent" on the Windows-Clients, the Service works again.

The server on which the ESET-Webconsole runs has been restarted. Thereafter the service "ESET Security Management Center Server" doesnt run anymore and now i cant login on the Webconsole. (Login failed. Connection has failed with state not connected")

It is very strange that the services "ESET Management Agent (Windows Clients)/ ESET Security Management Center Server" no longer start after a restart, it worked for many years.

Is it possible to get the service (ESET Management Center Server) up and running again, so i can upgrade the Management Center to ESET protect via the web console?

 

Thanks for your help

Timme

 

 

[Tom-ws 0]

Hello I have very similar problem - Is it possible that updates are blocking older consoles?

[JoeSimms 0]

Unfortunately I am seeing the same issue - I appreciate it's a legacy system but for several reasons it's not been updated.

Our server stopped working on the 15th of December - same error you are seeing and as with you, on a server that has been untouched.

I've not managed to resolve it after several days - and even restoring a backup still shows same problem.  What we have seen today is that resetting the server date/time back allows the ESMC server to start.   I've checked and all certificates in use are current also.

I can't see any obvious reason for the date/time reset to make it work

[Marcos 5,074]

Do you have a supported version of agent installed?

https://support-eol.eset.com/en/policy_business/product_tables.html

Version	Original Release Date	Latest Build	Latest Build Release Date	Current Status	Full Support	Limited Support
11.0	December 13, 2023	11.0.503.0	December 13, 2023	Full Support	Until next feature update (minimum until June 30, 2024)	Until June 30, 2026
10.1	June 27, 2023	10.1.1292.0	August 22, 2023	Limited Support	Ended (December 13, 2023)	Until December 31, 2025
10.0	November 10, 2022	10.0.1126.0	November 10, 2022	Limited Support	Ended (June 27, 2023)	Until June 30, 2025
9.1	July 14, 2022	9.1.1298.0	July 27, 2022	Limited Support	Ended (November 10, 2022)	Until November 30, 2024
9.0	October 28, 2021	9.0.1141.0	October 28, 2021	Limited Support	Ended (July 14, 2022)	Until July 14, 2024
8.1	June 24, 2021	8.1.1223.0	October 7, 2021	End of Life	Ended (October 28, 2021)	Ended (October 31, 2023)
8.0	December 9, 2020	8.0.1238.0	February 11, 2021	End of Life	Ended (June 23, 2021)	Ended (June 30, 2023)

[JoeSimms 0]

Hi,

Thanks for the quick reply - no both agent and server are running v7.2 ( appreciate the out of support issues ) but just trying to get this working today to support the existing clients - then allow us to progress to a supported version.

I can't understand why it just stopped working  - from the logs it failed with this loader error around 9pm on 15/12/23 when system was running OK.  A system restart made no change, ESMC and Agent both fail to start

A repair of the application fails as it can't start the service at the end (same "unable to update loader" error) and then rolls the installation back.

We had a working image on a cloned server drive from several months ago - when that failed as well when we booted that we tried the clock rollback and that allowed us to started both services OK - hence my worry we've hit some limit/date lock. 

We have server running offline during this testing so it's not talking to any end users when date/time reset.

Thanks

 

[JoeSimms 0]

On 12/18/2023 at 2:00 PM, Tom-ws said:

Hello I have very similar problem - Is it possible that updates are blocking older consoles?

I think it is some limitation in v7.2 and appears date related

I've tested it offline and online - so i don't believe it looks like anything is being blocked, but that could be possible ?

If i restart my server running ESMC with a system date of 8/12/23 - it works OK whether online or running offline - when i move the date to 9/12/23 or later and restart my server, then ESMC and Agent fails to start.

I'm testing it currently by changing date/time on server after booting it with an earlier date to get the services running - i don't know how long it will stay online though

[Marcos 5,074]

10 minutes ago, JoeSimms said:

If i restart my server running ESMC with a system date of 8/12/23 - it works OK whether online or running offline - when i move the date to 9/12/23 or later and restart my server, then ESMC and Agent fails to start.

Then it must be related to Entrust cert. which expired on Dec 8. Please upload here C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\em000_64\????\em000_64.dll (where ???? is a 4-digit number).

[JoeSimms 0]

Thanks

I've looked at properties of em000_64.dll and that seems to be the case

Entrust Extended Validation Code Signing CA = EVCS1 expired on 08/12/23

Is it possible to get an updated em000_64.dll or an alternative solution to this problem ?

Thanks

Joe .s

[JoeSimms 0]

em000_64.zip

I've uploaded it as a ZIP file (unsure if that is what you were requesting in previous message?)

Thanks

Joe.

[EloySantovena 0]

Here the same issue.

Services on server restarted this night not turn on again.

For example in another one that have a Snapshot created before the restart fix the issue, but this one still without starti

[Marcos 5,074]

We recommend upgrading the ESMC Server to a fully supported version of the ESET PROTECT Server and re-deploying the latest version of the management agent.

[JoeSimms 0]

I've tried to do that today - unfortunately so far i'm not able to

The ESMC 7.2 is running on a 2008R2 box - i've downloaded the oldest version that I can see on ESET site ( v9 )  but this is blocked from installing on this OS

I don't have access to a 7.2 installer to try to install this on a new server with a supported OS and then move database across before updating that to a supported version such as v11

Thanks

[Marcos 5,074]

I meant to install a supported version of ESET PROTECT, not an EOL version of ESMC 7.2. EOL versions won't work.

[JoeSimms 0]

I've tried all of them - all versions listed on the Eset site for download v11/v10/v9 will not install on 2008R2

I'm stuck with 2008R2 / v7.2 and no upgrade path currently (appreciate my fault for leaving it to this point! )

I've tried an in-place u/g to 2012R2 to then allow upgrade to a supported version, but that was unsuccessful

Thanks
 

[Marcos 5,074]

While it would be probably possible to obtain ESET PROTECT 10.1 installers with support for Windows Server 2008 R2, I'd recommend migrating to ESET PROTECT Cloud as per https://help.eset.com/protect_cloud/en-US/cloud_migration.htm if your license entitles you to.

ESET PROTECT 10.1 is in limited support until December 2025.

[JoeSimms 0]

Thanks

I will need to look at this - but i'm trying to get this working for now to allow updates to be pushed out to clients and monitoring to continue for them - then look at cloud etc...

v10 appears to support 2008r2 - i've checked prerequisites for it and should be OK ?  The installer says it is not a supported O/S when i try and run the upgrade.

[Marcos 5,074]

5 minutes ago, JoeSimms said:

v10 appears to support 2008r2 - i've checked prerequisites for it and should be OK ?  The installer says it is not a supported O/S when i try and run the upgrade.

Do you SP1 and these two Windows updates adding SHA-2 code signing support installed?

KB4474419

KB4490628

[JoeSimms 0]

Hi

Yes - it’s running SP1 and I rechecked both of them are installed 

[Marcos 5,074]

Well, yes, it's only agent 10.1 that can be installed on Windows Server 2008 R2. ESET PROTECT v8 is the latest which can be installed there but it's already reached EOL.

You could use a virtual appliance and re-deploy the management agent, however, support for CentOS that the VA is based on will sunset next year. Therefore we recommend migrating to ESET PROTECT Cloud.

[JoeSimms 0]

Ok - thanks for clarifying, i thought the server was supported on v10 but now understand that it is not

I appreciate that we'll need to move to either VM/Cloud - ideally i'd like to get the ESMC running again meantime so we can get pending updates completed which were planned for during this holiday break then look to migrate in a more planned fashion over the coming weeks

[jcook 1]

I have exactly the same issue after upgrading our ESMC to the latest version (yesterday) and pushing agent upgrades to the clients. At least one of the clients never came back online.
On that client I noticed the "Eset Management Agent" was not running. Starting it resulted in error in Event Log: 

Quote

The ESET Management Service service stopped with the following service-specific error. The remote server has stopped or is currently shutting down.

Then I investigated the "C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\ra-upgrade-agent_2024-01-03T19-13-24.log" file to see if I could find any clues.
I found pleanty of errors like this:

• Info 1603. The file C:\Program Files\ESET\RemoteAdministrator\Agent\xxxxxx.dll is being held in use. Close that application and retry.
• Error 1321. The Installer has insufficient privileges to modify this file: C:\Program Files\ESET\RemoteAdministrator\Agent\xxxxxx.dll.

I don't understand why the upgrade suddenly had not enough privileges, but clearly the agent was not upgraded and because it could connect to the server anymore, a manual reinstall of the agent was the only solution.
Hence I downloaded the latest version of the installed from our ESMC and ran that on the client.
That did not solve the problem because those downloaded installers are unable to upgrade Agents that are password protected.
So, I modified the PROTECTAgentinstaller.bat as explained here.
Running this modified installer redeployed the agent successfully and after a reboot the agent connected again.

So, I'm good for now. But clearly the initial agent push upgrade failed and I will have to wait and see if other clients will have this same issue.
And yes, this client also was a Windows 10 machine.

I hope this report helps anyone.

[Marcos 5,074]

If you mean that you had ESMC 7.x installed that reached EOL a long time ago and module updates were terminated in 2022 causing modules not to load due to certificate expiration on Dec 8, it's possible that issue could occur during upgrade if the agent could not start.

Please make sure that the management agent is always in limited support at least: https://support-eol.eset.com/en/policy_business/product_tables.html.

[jcook 1]

No we did not have ESMC 7.x installed. We are always pretty much up to date and were using v10.x.