ERA 6 - 30 servers hanging

[dao 0]

Hello Eset,

Issues with File Security in ERA6.

We installed ERA 6 fresh without any other security products before on the target machines.

Installed file security for 2008R2+2012R2 and configured the policy for update mirror and proxy, nothing else.

After one week with no issues the "file security" began blocking needed processes and mail-routing.

We created a policy that should overwrite current settings.

Ended with no solution. The service.msc can not disable the erkn.exe and in the erapanel it shows last request is current, but in the settingoption and viewing the client it is past.

So no other chance to boot in safe mode and uninstall eset. At the moment planing to do this also for all the physical machines. Its hurting and on the top the unlucky nothing was function what is needed for our business.

I hope that there is another solution without booting all the servers in safe mode and uninstalling eset?

Its a desaster.

Regard,

Dao

 

 

[Marcos 5,074]

If you have protocol filtering enabled, make sure the following hotfix is installed: hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN2567.

Does temporarily disabling protocol filtering, real-time protection or HIPS make a difference?

[dao 0]

With the policies no possibility to overwrite the client settings. on the clients/servers no local possibility to change settings.

The KB is not for 2012 only past systems. anyway not fixing the issue, tried on 2008R2 after installing and reboot next disaster, only temporary userprofile when logon, 3 reboots brings the domainprofile back... not recommending to install the KB!!

KB did not solve at all, next step would be? Let me guess "boot in safe mode" all the machines, let your time go and customers also?

[bbahes 29]

With the policies no possibility to overwrite the client settings. on the clients/servers no local possibility to change settings.

The KB is not for 2012 only past systems. anyway not fixing the issue, tried on 2008R2 after installing and reboot next disaster, only temporary userprofile when logon, 3 reboots brings the domainprofile back... not recommending to install the KB!!

KB did not solve at all, next step would be? Let me guess "boot in safe mode" all the machines, let your time go and customers also?

 

Regarding  temporary user profile, I've had this issue since I installed ESET V5 from first day...but haven't been unable to track what problem is. I still have this issue from time to time have on clients.

I've never tested File Security with ERA V6. We are still on V5. Did you test before deployment?

Also, what version of File Security did you install on servers?

[dao 0]

Tested with some client and server before rolling out to all machines.
it worked for one week, than without any action it stopped. everywhere it is the current version

[bbahes 29]

Tested with some client and server before rolling out to all machines.

it worked for one week, than without any action it stopped. everywhere it is the current version

 

Do you have patch management over servers? Maybe it's related to Microsoft Security Updates...

Maybe you can provide trace file here to support?

Edited August 19, 2015 by bbahes

[dao 0]

WSUS did not run, the only Thing could be that someone else removed a policy, but if this shoiuld be overwritten with the new forcing policy.

 

I already provided the logs and procmon and other stuff to the german support, they told they will forward it to the developers.

 

some errors are:

2015-08-18 16:56:25 Error: CSystemConnectorModule [Thread 7d8]: SoftwareUninstallation: Uninstallation command exited with (0x643): (0x643), Fatal error during installation

2015-08-18 20:42:38 Warning: Kernel [Thread 700]: Module library +ESLCConnector was not loaded

2015-08-19 12:00:15 Error: CEssConnectorModule [Thread a98]: CNodcommChannel: Send request failed
2015-08-19 12:00:15 Error: CEssConnectorModule [Thread 5a4]: CNodcommChannel: Get broadcast failed
2015-08-19 12:00:37 Error: CReplicationModule [Thread 158c]: CReplicationManager: Replication (network) connection to 'host: "server.loc" port: 2222' failed with: (0x79), The semaphore timeout period has expired