Endpoint 6 Causes Slow Domain Logon

[sturge33 0]

Over the last few weeks I've had users that are taking up to 10-15 minutes to log on to the domain. We are using EES 6. If I disable the Eset services or uninstall EES the problem goes away. Is there a setting that would cause domain logons to be this slow?

[Marcos 5,074]

Does renaming C:\Windows\System32\drivers\eamonm.sys or ehdrv.sys in safe mode make a difference?

[sturge33 0]

Renaming those two files did seem to make a big difference.  After renaming them EES says it is disabled.  How can I fix this?  I have already tried un-installing/re-installing EES and that did not help.

[Marcos 5,074]

Renaming those two files did seem to make a big difference.  After renaming them EES says it is disabled.  How can I fix this?  I have already tried un-installing/re-installing EES and that did not help.

 

The drivers are crucial for proper functioning of antivirus protection and I suggested to rename them just for a test. However, we don't know which of them has effect on the issue so please rename just one of them at a time.

[Piotr R. 0]

I have the same problem with very long logon to domain (Windows 10 PRO, Eset Endpoiont Antivirus 6, Windows 2003 STD AD).

Renaming folders doesn"t take efect because after that Eset real time protection is disable.

Is there any solution for this problem?

Now I remove antivirus from my computer and logon is very fast.

[Marcos 5,074]

I've asked to rename the eamonm.sys driver only temporarily to confirm or deny that the issue goes away. If renaming the driver helps, we'd need a Process monitor boot log for further analysis.

[Piotr R. 0]

Now I install newest version of ESET Endpoint Antivirus v6 6.3.2016.1 and problem is the same - very long logon to domain and system freezes and hangs.

The problem does not occur when I logon to local user (only is present when logon to domain user). The problem is present on another comupters in our organization with systems Windows 10 Pro and Windows 8.1 Pro.

Here"s link to Process monitor boot log from my comuter: https://drive.google.com/folderview?id=0B3ykwljHnvMkWDVsYjRkUDZJRUU&usp=sharing

[rbwicked 0]

Was this ever resolved / followed up on? We're seeing the same symptoms.

[espasso 0]

Same symptoms here:

 

- Windows Domain

- Mix of Windows 10 and 8.1 stations

- Endpoint Security 6.3.2016.2 with "Balanced" policy applied

- ERA Virtual Appliance:

 

I tried to uninstall/reinstall with no luck.

[Marcos 5,074]

Please answer my question in post #2, ie. whether temporarily renaming eamonm.sys or ehdrv.sys in safe mode makes a difference. It's crucial to narrow it down before proceeding with further troubleshooting. Before you start renaming the two drivers, you can also try temporarily disabling automatic start of real-time protection and restarting the computer. Let us know about your findings.

[Piotr R. 0]

The new version of ESET Endpoint Antivirus v6 6.4.2014.2 probably solving problem. I installed the new version and use it from two days and everything is ok.

[Jason Yeoman 0]

I found the problem is that if you have scan on file creation it slows down the domain login because it scans every file created when Windows copies the profile over for each new user.  With file creation scan on domain logins can take at least 3-4 mins or longer.  (if the same user logs into the computer again it's faster since the profile is already copied).  If file creation scan is disabled domain logins take about 30secs to a minute.  

 

Excluding folders would be less secure as well.