MacOS: Threat Prevention locking up with Disk Encryption
After a MacBook Pro with Disk Encryption via FileVault wakes up from an extended sleep state, the Threat Prevention service is locking up/crashing. This is causing a very noticeable drop in performance with a number of applications that access the disk for tasks, even Terminal is affected by this. Note: Web Control and Adaptive Threat Prevention come back online without issue.
Our only work around so far is to either reboot the system, or if they have admin access, so restart the services. I've removed disk encryption from my system and after an extended time in sleep mode, Threat Prevention came back online without issue. Unfortunately, due to sensitive customer information, we do require disk encryption.
Can this be caused by TP attempting to read files that are being encrypted post wake up & going back to plugged in power? If so, is there is a setting to tell TP to hold off on reading files being encrypted?
I'm testing on my own MBP right now and Encryption is off, I do plan on turning encryption back on and testing by downloading a large ISO file while the system is on battery (FileVault wont' encrypt until the system is awake and plugged in), close the lid, wait a while, plug in power, and open the lid back up to see if I can trigger a Threat Prevention crash that way.
2016 MBP i5
macOS Catalina: 10.15.6
McAfee Endpoint Security for Mac: 10.7.0 (142)
Version: 10.7.0 (182)
Engine Version: 61009.8979
DAT versions are most recent, no issue updating when Threat Prevention is working
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.