cancel
Showing results for 
Search instead for 
Did you mean: 
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 11 of 23

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

@NikolayE Would you be able to provide me with the SR number so I can look into the case and see what I am able to do in order to get you the traction you need?

EDIT: I see you've provided it in a different response. Thank you. I'll follow up.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

Thanks. Just as a side note.... I even tried to apply default McAfee Exploit Preventiton policy just in case mine was corrupt. Same result.

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 13 of 23

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

@NikolayE We've had some discussion with the technician working on your case and have assisted with some review of the logging and issue, and they should be reaching out to you with some additional next steps and plan for investigation.

Highlighted
Erikk
Level 7
Report Inappropriate Content
Message 14 of 23

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

We're experiencing this as well, on a physical Windows 8.1 laptop. As soon as ENS gets installed, all user GUI dissappears and user only has an unusable black screen. After uninstalling ENS, and starting explorer.exe, everything is fine again.

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

We identified and resolved the problem. It was caused by 3rd party antimalware product called "Crowdstrike" which was colliding with McAfee exploit prevention. We modified one of the "Crowdstrike" policies to resolve the problem.

Erikk
Level 7
Report Inappropriate Content
Message 16 of 23

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

Thanks. We're not using any other security products though.

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

This appeared to be my issue as well.  A specific CrowdStrike Sensor update caused the issue.  

Curiously enough, an update to McAfee ENS 10.6.1 December Update corrected the issue.

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

Can you tell us what you changed in Crowdstrike to fix this 

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

Disable - Additional User Mode Data in Crowdstrike

Re: Black screen on Windows 10 VMs with ENS 10.5.5

Jump to solution

I'm seeing this issue as well; however, I'm seeing it primarily on physical machines.  

The issue is first noticed as Internet Explorer or another browser not launching on a computer.  When the user restarts, they typically do not have the GUI desktop upon Windows logon (the shell, explorer.exe, will not run).  We can launch Task Manager and run a new task (either explorer.exe or iexplore.exe) and watch the process spawn, but die very quickly.  Exploit Prevention (and ENS as a whole) is not logging any threats or blocks, but when we disable Exploit Prevention (via policy update in ePO), the issue is no longer present.  Because a threat or block is not logged, I can not pin this on any specific ID.  I have an open SR, but Support has not been helpful and appears to not have even reviewed the MER or logs that I have sent in.

Reviewing the Debug log for Exploit Prevention, I can see several Warnings when I try to spawn the iexplore or explorer process:
12/19/2018 10:08:00.443 AM mfetp(7628.1928) <SYSTEM> TmpLogger.Gbop.Debug: [s] Warn : 0x1dcc,788 AddJobEx: pid 0x3058, Already in the job map with job state 0x1

Additionally, there are occasional errors in the debug log as well: 

12/19/2018 10:08:00.486 AM mfetp(7628.2672) <SYSTEM> TmpLogger.Gbop.Debug: [s] Error: 0x1dcc,a70 Error: HamQ error code: 0xd

 

Updates to ENS and McAfee Agent do not correct the issue.

MA: 5.5.1.388

ENS: 10.6.1

OS: Windows 10 v 1803 & 1809

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community