ENS versions after 2298 break Azure Backup

[marksmith972]

After upgrading servers beyond ENS version 2298 servers being backed up using Azure backup begin to have Azure backup issues. We have implemented the Microsoft recommended scanning exclusions. The issues only start after the server is rebooted post upgrade. Azure backup continues to work OK until the reboot. After a server hits the issue it can be downgraded to ENS 2298 as a workaround for the issue. However, we don't want to leave servers running ENS 2298. We try new releases of ENS to see if the issue still exists but up to now the issue is still there. The error we see is DATA FAILURE 0x80070002. This was reported to Microsoft who simply say that something is interfering with the snapshot process as its writing the data. Has anyone else come across this issue?

[AdithyanT]

Hi @marksmith972,

Thank you for reporting this. I have come across a very similar incident in the past where "cbengine.exe" used to get blocked as it attempts to touch ENS files during its backup routine (I presume) and thereby fails since our self protection blocks that from happening!

The solution on the above was to either disable Self protection during this process or add "cbengine.exe" under exclusions in ENS common policy.

I would recommend going through the "Self protection.log" file within ENS logs Folder to confirm if the issue is indeed the same.

[marksmith972]

Thank you for the suggestion. We already have cbengine.exe set as a Low Risk process. I've checked the self-protection log file but it only contained issues with smhstart.exe which is HP's System Management Homepage Service.

[AdithyanT]

Hi @marksmith972 ,

Thank you for the update. In his case I would recommend following the second post from my nd that talks about component isolation.

This would help us isolate which component is causing the issue and further add necessary exclusions as needed to specific component/feature.

[AdithyanT]

Hi @marksmith972,

As a general recommendation, I would recommend progressive disabling of components to narrow down which component is exactly causing the issue here!

It would go something like this:

1. Disable On-Access Scan. If the issue goes away, re-enable On-Access Scan and then disable the following options and test after each. Otherwise, continue to the next step.
   • Scan Boot Sectors
   • Scan Processes on enable
   • Scan Trusted installers (if there’s an application installation involved)
   • ScriptScan
   • Scan on Network Drives
   • Scan when writing to disk
   • Scan when reading from disk
   • Find unknown unwanted programs and trojans
   • Find unknown macro threats
   • Scan inside archives
   • Decode MIME encoded files
   • Detect unwanted programs
2. Disable Access Protection. If the high issue goes away, re-enable Access Protection and then disable blocking and reporting on each of the Access Protection Rules and test after each. Otherwise, continue to the next step.
3. Disable Exploit Prevention. If the issue goes away, re-enable Exploit Prevention and then disable each signature and Application Protection Rule and test after each.