Windows 10 crashing with DLP 11.9

[bitc]

Hi,

we did a rollout of DLP 11.9 (11.6 before) and after a short time we got crashes - this "there was a problem" screen and reboot.

- It looks like, that the crash occures only, when a user do logon - not if the client is in login screen.

I did a guess and set DLP windows client config > mode > to "device control only" (was complete protection). After a policy update - no crashes.

So far we ony had this crashes on laptops / tablets - it may be is some conflict or so with another software - e.g. MS Teams, Onedrive (as disable content/full protection fixed that issue)

Anyone else? Any ideas?

[Dex]

Hello @bitc In my case, I have a problem with Google Chrome 97 and Windows 11. Chrome doesn't work after updating to DLP 11.9 and it only works if I disable Chrome and Edge Web Handler or uninstall DLP. Also, DLP 11.6.401 causes strange OS performance degradation and this happens more with Chrome.

I will keep DLP 11.6.400 on our systems until this behavior is resolved.

Perhaps these latest versions were not properly tested before moving to GA.

[tucker84]

we've had mixed results with the 11.6.401 patch. It resolved an issue with one of our backup systems but caused an issue where I couldn't even bring a package into ePO. Really strange behavior

[ISmith]

I also had 2 out of around 30 machines encounter blue screen crash in Win10 20H2/1 (19041.19042) when Endpoint DLP 11.9 starts.

Due to this, I cannot implement a wide deployment.

I had the agent on a 2 minute delay after logon, which is when my machines encountered the BSOD.

[bitc]

ISmith: did you try my solution? If you only need device control so far - this should help.

[ISmith]

No. that is an operational mode that is pointless for me. If I cannot use DLP for removable media and browser + cloud data transfers, then I might as well uninstall and find another solution.

In my case, most machines did not have the issue, which means there is some change that is sensitive to something else. No idea what. There are dozens of apps and programs involved.

[bitc]

Ok, I understand. I didn't had the time to test it and the clients are remote, home office, mobile ... so I not really want to try if I get a BOD again - but somehow I guess that it is OneDrive related - as the main difference between the crashing mobile and not-crashing (PC) clients is, that the mobile ones use OneDrive - that means - the user has an account logged in.

And 2nd: after the update there was a message saying ... "you date on cloud storage will be protected/encrypted" or so - though we do not use that function - and - as far as I can see - the data is stored unencrypted.

Oh - btw - we had some issues with corrupted Office (Excel) files on Onedrive storage - not sure if this is also DLP related. Could be sth else ... but as far as I know no user was complaining of corrupted files after deactivation of cloud protection.

[ISmith]

We do not have OneDrive enabled widespread, and at least one of the machines with BSOD did not have onedrive configured.

The message about cloud storage is an FRP issue beginning with  (I think) FRP 5.2. I had opened a support case with McAfee support about this and received a semi-fix. FRP will deliver the message (in the default browser). The resolution is to customize the message but there appears to be no way to kill it all together. 

I have seen no corruption of files on OneDrive yet. 

[TrentD]

@bitc, are your systems running the 11th generation Intel CPU?

If so, please KB article below...Thanks

System crash (blue screen) on 11th generation Intel and AMD Zen 3 Ryzen CPUs
Technical Articles ID: KB95295
Last Modified: 2/17/2022
Environment
Data Loss Prevention (DLP) Endpoint 11.9.0
https://kc.mcafee.com/corporate/index?page=content&id=KB95295