cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 1 of 62

Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Widows 10 fails to detect McAfee ENS 10.6.1 running and windows defender kicks in. This is affecting us due to the fact that our VPN client does a host check and will only allow systems through if McAfee is running and definitions are up to date.

Annotation 2019-07-25 065202.png

 

If we click "Turn On", that is all it takes to fix the issue and VPN connection works normally, but after a couple restarts, the system will revert to this state again forcing the user to manually hit "Turn ON".

All ENS modules look "enabled" in the console and there arent any other indications of an issue other than Windows Defender being turned ON and the "security providers" showing that shown in the screenshot.

Windows Version 10.0.17763 Build 17763
OS Name Microsoft Windows 10 Pro

ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)
Platform: 10.6.1.1555
Threat prevention: 10.6.1.1638

This wasn't happening before and wondering if other people are seeing the same and if there is a solution.

Labels (1)
61 Replies
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 2 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Could you confirm the exact OS and ENS version installed?

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 3 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Thank you @chealey 

 

Windows Version 10.0.17763 Build 17763
OS Name Microsoft Windows 10 Pro

ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)
Platform: 10.6.1.1555
Threat prevention: 10.6.1.1638

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 4 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Great thanks!

https://kc.mcafee.com/corporate/index?page=content&id=KB91428 >> we did fix this in the May Update so you should definitely not be seeing it with the July Update.

 

To help us expedite and troubleshoot this, kindly raise a service request with support. If possible provide the following data to get it reviewed as quickly as possible:

Set debug logging for all ENS modules.
Set amtrace and procmon to log at boot. See KB86691 for parameters.
Restart the system.
Open WSC and check status. Stop amtrace and procmon.
Collect MER, amtrace, and procmon log.

Get the output of the command below; run with Admin CMD prompt:
powershell Get-WmiObject -Namespace "root\SecurityCenter2" -Class "AntiVirusProduct"

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 5 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

there goes half of my day for the next two weeks.... Like every time I have to work with support and collect random logs. This issue is intermittent, it is not occurring 100% of the time......

I'll try to collect all that stuff when i have time.

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 6 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

I'd like to save you the hassle and collect this myself but my test machine is not displaying this same behaviour. Sorry!

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 7 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

@chealeyThis issue seems to be ramping up dramatically with my deployment of the July update repost version of ENS in combination with Windows 10 1903 may feature upgrade installation.

I will try to capture the plethora of logs you asked and create a ticket but its quite ridiculous that McAfee cannot work on this on their own.

Endpoint Security Threat Prevention 10.6.1.1666
Endpoint Security Firewall 10.6.1.1340
Endpoint Security Platform 10.6.1.1607
Endpoint Security Web Control 10.6.1.1435
Endpoint Security Adaptive Threat Protection 10.6.1.1421

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 8 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Hey Kyle, I would happily work on this with data collected from my own machine but the problem is, I haven't been able to replicate this behaviour on my 1903 test machine yet. Appreciate your assistance to get this looked into.
Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
McAfee Employee AdithyanT
McAfee Employee
Report Inappropriate Content
Message 9 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Hi @kylekat ,

Firstly, Thank you for all the effort and time you are investing into this. I certainly agree that this activity of log collection and uploading them to the Service Request is exhausting to you and I really wish I could help you out reducing efforts to none or minimum, unfortunately, I have attempted both upgrade installation (from December installation to May update patch and then apply July repost and I also tried running a clean install of July update and I am unable to re produce the issue from my end. However, I have just come across another McAfee User I am working with who has this issue.

However, I am fairly confident this is a Cosmetic issue and would like to confirm it with only one step - an EICAR test. This should let us know why Windows Security Center is displaying the information this way.

Also, Can you please help me with value displayed in this key(if it exists)?

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}

If the "STATE" DWORD is any value other than 397312, Please do let me know so that I can confirm the issue is same.

These 2 steps as stated above should give us a confirmation whether the issue is cosmetic or if it is affecting the product's functionality.

Also, If these values match, I will be checking this from my end with the Engineering team with the helps of logs I have collected from my client and see their recommendations are useful to you as well.

We really look forward to your kind response on this and my goal is to ensure you put minimal effort from your end considering you having tested out several scenarios already from your end. In case the information you provided does not match with what I have observed form the ticket I am already working on,then, I am afraid we may have to create a new ticket for you with all the required logs.

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,
Adithyan T
McAfee Technical Support
Reliable Contributor kylekat
Reliable Contributor
Report Inappropriate Content
Message 10 of 62

Re: Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

Thank you @AdithyanT and @chealey. I uplaoded more evidence to my ticket i've sent via private message, but here are some answers:

I did an eicar test file on a system experiencing the problem and it looks like Windows Defender blocked it instead of mcafee.

Annotation 2019-08-29 073054.png

And the regkey:

Annotation 2019-08-29 074140.png

 

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community