ESETFDE dlpfde.sys causing issues

[NobelDwarf 2]

Hi, 

I have machines updated with Windows 11 24H4 either by Windows update or fresh from the ISO. Once the ESET FDE is installed it stops the machine from shutting down, when you click on the shutdown button on the start menu it shows the shutdown screen for a couple of seconds then the screen goes off but it goes into sleep mode. If you move the mouse it wakes up but if you hold shift + shutdown it fully shuts down.

After doing some investigation I found it's the dlpfde.sys driver causing it used in HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DumpFilters which has "dumpfve.sys and dlpfde.sys" listed it creates an error in the event logs as you can see in the screenshot below.

Machines using the older version of Windows 11 23H2 don't have these issues and don't show the error in event logs.

 

Once I change the DumpFilters reg key, remove your dlpfde.sys and leave the default windows one of dumpfve.sys it allows the machine to work normally again by allowing shutdown

 

[AAndrejko 14]

Hi @NobelDwarf

This issue has been fixed internally in both ESET Full Disk Encryption and ESET Endpoint Encryption.

A fixed version of EEE we are due to release roughly the start of December. EFDE we expect to release around the January time.

This issue as you've pointed out is just an issue with 24H2 so I'd suggest you don't update the rest of your systems with EFDE or EEE on just yet.

Kind regards,

Ashley

[NobelDwarf 2]

1 minute ago, AAndrejko said:

Hi @NobelDwarf

This issue has been fixed internally in both ESET Full Disk Encryption and ESET Endpoint Encryption.

A fixed version of EEE we are due to release roughly the start of December. EFDE we expect to release around the January time.

This issue as you've pointed out is just an issue with 24H2 so I'd suggest you don't update the rest of your systems with EFDE or EEE on just yet.

Kind regards,

Ashley

Hi Ashley,

 

Thanks for the clarification are there any effects of removing your driver from the DumpFilters until this is fixed for the machines that have already been upgraded? As we currently have 5 machines updated and having this issue until the fix is out in January?

 

Thanks 

[AAndrejko 14]

31 minutes ago, NobelDwarf said:

Hi Ashley,

 

Thanks for the clarification are there any effects of removing your driver from the DumpFilters until this is fixed for the machines that have already been upgraded? As we currently have 5 machines updated and having this issue until the fix is out in January?

 

Thanks 

Hi @NobelDwarf

It seems actually the issue is a combination of things. So if you turn off fast startup and hibernate on these devices temporarily then it should resolve the issue until the new version comes around.

Kind regards

Ashley

[TUrheim 0]

Hello, I have the same problem with a customer using ESET Advanced ESET Endpoint Security 11.1.2052.0 and Full Disk Encryption 2.018.0. Microsoft Windows [Version 10.0.22631.4460] i.e. version 23H2!

Every time I try to create a full backup with BackupAssist version 14.01 I get:

112024-17718-01.dmp 11/20/2024 4:52:36 PM SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 0x1000007e ffffffff`c0000005 fffff806`4a00fccd fffffc0a`2c8776c8 fffffc0a`2c876ee0 dlpfde.sys dlpfde.sys+fccd ESET Disk Encryption Driver [64-bit] ESET Endpoint Encryption ESET, spol. s r.o. 2.4.99.282 x64 dlpfde.sys+fccd C:\windows\Minidump\112024-17718-01.dmp 18 15 22621 7’482’002 11/20/2024 4:55:13 PM What can I do?

[Kstainton 39]

Hi @TUrheim,

Please get in touch via https://www.eset.com/int/support/contact/ to allow us to investigate your issue.

Thank you,

Kieran

[TUrheim 0]

For others with the same issue. I found a workaround for my constellation, until Eset is correcting the issue with the dlpfde.sys.

In BackupAssist there are two ways to make a full Backup.

• In the constellation Backupassist with the new Backup-engine  and ESET full encryption there is always a Crash
• with the old Backup engine (i guess BackupAssist use the Windows Block level Backup Engine) it still works.