Jump to content

ESET Management Agent doesnt start - Unable to load Loader


Recommended Posts

Hello everyone, 

the service "Eset Management Agent" has not startet for a few days now.

This means that the clients cannot connect to the "ESET Security Management Center".

It affects almost all of our Windows-10 computers. (around 150)

When I try to start the service manually, the Windows-Clients shows: "ESET Management Agent on local computer failed to start. For more information, see the system event log. Contact the service manufacturer. Refer to service specific error code 70" 

The trace.log  contains following:  

2023-12-14 10:41:17 Information: [Thread 690]: Loading ESET modules from C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\
2023-12-14 10:41:17 Error: Service [Thread 690]: ModuleManager: Unable to load Loader.

Windows event viewer:

The ESET Management Service service stopped with the following service-specific error. The remote server has stopped or is currently shutting down.

Versions:

ESET Management Agent 7.2.1266.0

ESET Endpoint Antivirus 10.1.2050.0

Does anyone know this problem or know a few possible solutions?

Thank you very much.

Best regards Timme

 


 

Link to comment
Share on other sites

Hi Marcos,

thanks for your answer.

After a reinstallating the "ESET Management Agent" on the Windows-Clients, the Service works again.

The server on which the ESET-Webconsole runs has been restarted. Thereafter the service "ESET Security Management Center Server" doesnt run anymore and now i cant login on the Webconsole. (Login failed. Connection has failed with state not connected")

It is very strange that the services "ESET Management Agent (Windows Clients)/ ESET Security Management Center Server" no longer start after a restart, it worked for many years.

Is it possible to get the service (ESET Management Center Server) up and running again, so i can upgrade the Management Center to ESET protect via the web console?

 

Thanks for your help

Timme

 

 

Link to comment
Share on other sites

  • 2 weeks later...

Unfortunately I am seeing the same issue - I appreciate it's a legacy system but for several reasons it's not been updated.

Our server stopped working on the 15th of December - same error you are seeing and as with you, on a server that has been untouched.

I've not managed to resolve it after several days - and even restoring a backup still shows same problem.  What we have seen today is that resetting the server date/time back allows the ESMC server to start.   I've checked and all certificates in use are current also.

I can't see any obvious reason for the date/time reset to make it work

Link to comment
Share on other sites

  • Administrators

Do you have a supported version of agent installed?

https://support-eol.eset.com/en/policy_business/product_tables.html

Version Original Release Date Latest Build Latest Build Release Date Current Status Full Support Limited Support
11.0 December 13, 2023 11.0.503.0 December 13, 2023 full.svg Full Support Until next feature update (minimum until June 30, 2024) Until June 30, 2026
10.1 June 27, 2023 10.1.1292.0 August 22, 2023 limited.svg Limited Support Ended (December 13, 2023) Until December 31, 2025
10.0 November 10, 2022 10.0.1126.0 November 10, 2022 limited.svg Limited Support Ended (June 27, 2023) Until June 30, 2025
9.1 July 14, 2022 9.1.1298.0 July 27, 2022 limited.svg Limited Support Ended (November 10, 2022) Until November 30, 2024
9.0 October 28, 2021 9.0.1141.0 October 28, 2021 limited.svg Limited Support Ended (July 14, 2022) Until July 14, 2024
8.1 June 24, 2021 8.1.1223.0 October 7, 2021 eol.svg End of Life Ended (October 28, 2021) Ended (October 31, 2023)
8.0 December 9, 2020 8.0.1238.0 February 11, 2021 eol.svg End of Life Ended (June 23, 2021) Ended (June 30, 2023)
Link to comment
Share on other sites

Hi,

Thanks for the quick reply - no both agent and server are running v7.2 ( appreciate the out of support issues ) but just trying to get this working today to support the existing clients - then allow us to progress to a supported version.

I can't understand why it just stopped working  - from the logs it failed with this loader error around 9pm on 15/12/23 when system was running OK.  A system restart made no change, ESMC and Agent both fail to start

A repair of the application fails as it can't start the service at the end (same "unable to update loader" error) and then rolls the installation back.

We had a working image on a cloned server drive from several months ago - when that failed as well when we booted that we tried the clock rollback and that allowed us to started both services OK - hence my worry we've hit some limit/date lock. 

We have server running offline during this testing so it's not talking to any end users when date/time reset.

Thanks

 

Link to comment
Share on other sites

On 12/18/2023 at 2:00 PM, Tom-ws said:

Hello I have very similar problem - Is it possible that updates are blocking older consoles?

I think it is some limitation in v7.2 and appears date related

I've tested it offline and online - so i don't believe it looks like anything is being blocked, but that could be possible ?

If i restart my server running ESMC with a system date of 8/12/23 - it works OK whether online or running offline - when i move the date to 9/12/23 or later and restart my server, then ESMC and Agent fails to start.

I'm testing it currently by changing date/time on server after booting it with an earlier date to get the services running - i don't know how long it will stay online though

Link to comment
Share on other sites

  • Administrators
10 minutes ago, JoeSimms said:

If i restart my server running ESMC with a system date of 8/12/23 - it works OK whether online or running offline - when i move the date to 9/12/23 or later and restart my server, then ESMC and Agent fails to start.

Then it must be related to Entrust cert. which expired on Dec 8. Please upload here C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Modules\em000_64\????\em000_64.dll (where ???? is a 4-digit number).

Link to comment
Share on other sites

Thanks

I've looked at properties of em000_64.dll and that seems to be the case

Entrust Extended Validation Code Signing CA = EVCS1 expired on 08/12/23

Is it possible to get an updated em000_64.dll or an alternative solution to this problem ?


Thanks


Joe .s

Link to comment
Share on other sites

  • Administrators

We recommend upgrading the ESMC Server to a fully supported version of the ESET PROTECT Server and re-deploying the latest version of the management agent.

Link to comment
Share on other sites

I've tried to do that today - unfortunately so far i'm not able to

The ESMC 7.2 is running on a 2008R2 box - i've downloaded the oldest version that I can see on ESET site ( v9 )  but this is blocked from installing on this OS

I don't have access to a 7.2 installer to try to install this on a new server with a supported OS and then move database across before updating that to a supported version such as v11

Thanks

Link to comment
Share on other sites

I've tried all of them - all versions listed on the Eset site for download v11/v10/v9 will not install on 2008R2

I'm stuck with 2008R2 / v7.2 and no upgrade path currently (appreciate my fault for leaving it to this point! )

I've tried an in-place u/g to 2012R2 to then allow upgrade to a supported version, but that was unsuccessful

Thanks
 

Link to comment
Share on other sites

  • Administrators

While it would be probably possible to obtain ESET PROTECT 10.1 installers with support for Windows Server 2008 R2, I'd recommend migrating to ESET PROTECT Cloud as per https://help.eset.com/protect_cloud/en-US/cloud_migration.htm if your license entitles you to.

ESET PROTECT 10.1 is in limited support until December 2025.

Link to comment
Share on other sites

Thanks

I will need to look at this - but i'm trying to get this working for now to allow updates to be pushed out to clients and monitoring to continue for them - then look at cloud etc...

v10 appears to support 2008r2 - i've checked prerequisites for it and should be OK ?  The installer says it is not a supported O/S when i try and run the upgrade.

Link to comment
Share on other sites

  • Administrators
5 minutes ago, JoeSimms said:

v10 appears to support 2008r2 - i've checked prerequisites for it and should be OK ?  The installer says it is not a supported O/S when i try and run the upgrade.

Do you SP1 and these two Windows updates adding SHA-2 code signing support installed?

KB4474419

KB4490628

Link to comment
Share on other sites

  • Administrators

Well, yes, it's only agent 10.1 that can be installed on Windows Server 2008 R2. ESET PROTECT v8 is the latest which can be installed there but it's already reached EOL.

You could use a virtual appliance and re-deploy the management agent, however, support for CentOS that the VA is based on will sunset next year. Therefore we recommend migrating to ESET PROTECT Cloud.

Link to comment
Share on other sites

Ok - thanks for clarifying, i thought the server was supported on v10 but now understand that it is not

I appreciate that we'll need to move to either VM/Cloud - ideally i'd like to get the ESMC running again meantime so we can get pending updates completed which were planned for during this holiday break then look to migrate in a more planned fashion over the coming weeks

Link to comment
Share on other sites

I have exactly the same issue after upgrading our ESMC to the latest version (yesterday) and pushing agent upgrades to the clients. At least one of the clients never came back online.
On that client I noticed the "Eset Management Agent" was not running. Starting it resulted in error in Event Log: 

Quote

The ESET Management Service service stopped with the following service-specific error. The remote server has stopped or is currently shutting down.


Then I investigated the "C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\ra-upgrade-agent_2024-01-03T19-13-24.log" file to see if I could find any clues.
I found pleanty of errors like this:

  • Info 1603. The file C:\Program Files\ESET\RemoteAdministrator\Agent\xxxxxx.dll is being held in use. Close that application and retry.
  • Error 1321. The Installer has insufficient privileges to modify this file: C:\Program Files\ESET\RemoteAdministrator\Agent\xxxxxx.dll.

I don't understand why the upgrade suddenly had not enough privileges, but clearly the agent was not upgraded and because it could connect to the server anymore, a manual reinstall of the agent was the only solution.
Hence I downloaded the latest version of the installed from our ESMC and ran that on the client.
That did not solve the problem because those downloaded installers are unable to upgrade Agents that are password protected.
So, I modified the PROTECTAgentinstaller.bat as explained here.
Running this modified installer redeployed the agent successfully and after a reboot the agent connected again.

So, I'm good for now. But clearly the initial agent push upgrade failed and I will have to wait and see if other clients will have this same issue.
And yes, this client also was a Windows 10 machine.

I hope this report helps anyone.

Link to comment
Share on other sites

  • Administrators

If you mean that you had ESMC 7.x installed that reached EOL a long time ago and module updates were terminated in 2022 causing modules not to load due to certificate expiration on Dec 8, it's possible that issue could occur during upgrade if the agent could not start.

Please make sure that the management agent is always in limited support at least: https://support-eol.eset.com/en/policy_business/product_tables.html.

Link to comment
Share on other sites

No we did not have ESMC 7.x installed. We are always pretty much up to date and were using v10.x. 

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...