ESETFDE dlpfde.sys causing issues

[NobelDwarf 2]

Hi, 

I have machines updated with Windows 11 24H4 either by Windows update or fresh from the ISO. Once the ESET FDE is installed it stops the machine from shutting down, when you click on the shutdown button on the start menu it shows the shutdown screen for a couple of seconds then the screen goes off but it goes into sleep mode. If you move the mouse it wakes up but if you hold shift + shutdown it fully shuts down.

After doing some investigation I found it's the dlpfde.sys driver causing it used in HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DumpFilters which has "dumpfve.sys and dlpfde.sys" listed it creates an error in the event logs as you can see in the screenshot below.

Machines using the older version of Windows 11 23H2 don't have these issues and don't show the error in event logs.

 

Once I change the DumpFilters reg key, remove your dlpfde.sys and leave the default windows one of dumpfve.sys it allows the machine to work normally again by allowing shutdown

 

[AAndrejko 15]

Hi @NobelDwarf

This issue has been fixed internally in both ESET Full Disk Encryption and ESET Endpoint Encryption.

A fixed version of EEE we are due to release roughly the start of December. EFDE we expect to release around the January time.

This issue as you've pointed out is just an issue with 24H2 so I'd suggest you don't update the rest of your systems with EFDE or EEE on just yet.

Kind regards,

Ashley

[NobelDwarf 2]

1 minute ago, AAndrejko said:

Hi @NobelDwarf

This issue has been fixed internally in both ESET Full Disk Encryption and ESET Endpoint Encryption.

A fixed version of EEE we are due to release roughly the start of December. EFDE we expect to release around the January time.

This issue as you've pointed out is just an issue with 24H2 so I'd suggest you don't update the rest of your systems with EFDE or EEE on just yet.

Kind regards,

Ashley

Hi Ashley,

 

Thanks for the clarification are there any effects of removing your driver from the DumpFilters until this is fixed for the machines that have already been upgraded? As we currently have 5 machines updated and having this issue until the fix is out in January?

 

Thanks 

[AAndrejko 15]

31 minutes ago, NobelDwarf said:

Hi Ashley,

 

Thanks for the clarification are there any effects of removing your driver from the DumpFilters until this is fixed for the machines that have already been upgraded? As we currently have 5 machines updated and having this issue until the fix is out in January?

 

Thanks 

Hi @NobelDwarf

It seems actually the issue is a combination of things. So if you turn off fast startup and hibernate on these devices temporarily then it should resolve the issue until the new version comes around.

Kind regards

Ashley

[TUrheim 0]

Hello, I have the same problem with a customer using ESET Advanced ESET Endpoint Security 11.1.2052.0 and Full Disk Encryption 2.018.0. Microsoft Windows [Version 10.0.22631.4460] i.e. version 23H2!

Every time I try to create a full backup with BackupAssist version 14.01 I get:

112024-17718-01.dmp 11/20/2024 4:52:36 PM SYSTEM_THREAD_EXCEPTION_NOT_HANDLED 0x1000007e ffffffff`c0000005 fffff806`4a00fccd fffffc0a`2c8776c8 fffffc0a`2c876ee0 dlpfde.sys dlpfde.sys+fccd ESET Disk Encryption Driver [64-bit] ESET Endpoint Encryption ESET, spol. s r.o. 2.4.99.282 x64 dlpfde.sys+fccd C:\windows\Minidump\112024-17718-01.dmp 18 15 22621 7’482’002 11/20/2024 4:55:13 PM What can I do?

[Kstainton 42]

Hi @TUrheim,

Please get in touch via https://www.eset.com/int/support/contact/ to allow us to investigate your issue.

Thank you,

Kieran

[TUrheim 0]

For others with the same issue. I found a workaround for my constellation, until Eset is correcting the issue with the dlpfde.sys.

In BackupAssist there are two ways to make a full Backup.

• In the constellation Backupassist with the new Backup-engine  and ESET full encryption there is always a Crash
• with the old Backup engine (i guess BackupAssist use the Windows Block level Backup Engine) it still works.

[NobelDwarf 2]

On 11/7/2024 at 10:16 AM, AAndrejko said:

Hi @NobelDwarf

This issue has been fixed internally in both ESET Full Disk Encryption and ESET Endpoint Encryption.

A fixed version of EEE we are due to release roughly the start of December. EFDE we expect to release around the January time.

This issue as you've pointed out is just an issue with 24H2 so I'd suggest you don't update the rest of your systems with EFDE or EEE on just yet.

Kind regards,

Ashley

Hi Ashley,

Do you have a rough estimate of when the update for EFDE will be released this month to fix the issue with Windows 24H2?

Thanks

[AAndrejko 15]

30 minutes ago, NobelDwarf said:

Hi Ashley,

Do you have a rough estimate of when the update for EFDE will be released this month to fix the issue with Windows 24H2?

Thanks

Hi @NobelDwarf

Unfortunately I cannot say for certain a definite release date to fix the issue at this time. Internally it has been fixed, we're just building up to a release which should go out mid Feb, lots of other things still pending though.

As previously stated though, if you turn off Fast Start-up the issue should not occur.

Kind regards,

Ashley

 

[NobelDwarf 2]

1 minute ago, AAndrejko said:

Hi @NobelDwarf

Unfortunately I cannot say for certain a definite release date to fix the issue at this time. Internally it has been fixed, we're just building up to a release which should go out mid Feb, lots of other things still pending though.

As previously stated though, if you turn off Fast Start-up the issue should not occur.

Kind regards,

Ashley

 

Hi Ashely,

Thanks for coming back turning off fast start-up does fix the shutdown bug, but it still has the issue of stopping the machine from sleeping. If you close the lid it will just turn off the screen but keeping the machine online drains the battery overnight and with Windows starting to push out the new update the number of machines having this bug is increasing.

Is there a fix for the sleeping issue, or will we just have to wait until the update comes out?

Thanks

[AAndrejko 15]

Hi @NobelDwarf

We haven't identified a problem with sleep on Encrypted systems. On a system that has the problem have you tried to decrypt and uninstall EFDE to see if the problem persists? 

Personally I've seen this due to system drivers not supporting new features/changes within Windows.

Kind regards,

Ashley