MacOS frozen system

[User86482369]

McAfee freezes (1-2 min) the system (MacOS) in the following cases: 1) For a few seconds when you turn on MacBook 2) Spontaneously during work We tried to disable On-Access Scan but it didn't help System for example: OS Type:macOS,OS Platform:Workstation,OS Version:10.15.4,OS Service Pack Version:4 McAfee DXL Client -6.0.0.218 Endpoint Security Threat Prevention -10.6.9.107 Endpoint Security Firewall 10.6.9.100 Endpoint Security Platform 10.6.9.104 Endpoint Security Web Control 10.6.4.110 Agent 5.6.5.165 Management of Native Encryption 5.0.2.109 DLP Endpoint 11.4.0.20 Endpoint Security Adaptive Threat Protection 10.6.9.103

[loganvandyke]

Same issue here, trying to work with McAfee support. We're seeing kernel panics and system crashes. ENS 10.6.8 and 10.6.9 on Mojave and Catalina machines.

[User86482369]

We tried remove Threat Prevention and other modules: DLP Endpoint 11.4.0.20 Endpoint Security Platform 10.6.9.104 Endpoint Security Threat Prevention 10.6.9.107 Endpoint Security Firewall 10.6.9.100 Management of Native Encryption 5.0.2.109 Endpoint Security Adaptive Threat Protection 10.6.9.103 But this didn’t help.

User  saw mee  "the fingerprint works, the touchbar works, and the keyboard and touchpad don't"

[lonieva]

Hi @User86482369 ,

If you have tried to uninstall ENS or disable completely the product, and the issue disappears, can you please open a service request?

We will check this with you.

[SuperAdmin-mhc]

Hello, 

I am experiencing the same issue as everyone here. The slight difference is I notice that Mac overheats.  I have the same versions that everyone else here have and Mac freezes randomly.   I removed all the McAfee products and the Mac works like a charm (no overheating and no freezing).  This was deployed recently on my organization.  I was wondering if you guys found a real solution? 

[gururaj]

Hi,

What are all mcafee components you have on your mac machines. kindly generate MER and raise service request for the same. to troubleshoot the issue.

Regards,

Gururaj.m.d

[SuperAdmin-mhc]

Hi, 

I made some changes in an attempt to fix my issue without no avail.  However, I discovered that the McAfee product causing this issue is McAfee Threat Prevention for Mac. I had version 10.6.9.x and upgraded to 10.7.0 and I am facing same issues.  If I leave ENS Threat Prevention the client (macOS Mojave, all up to date) does not freeze.   

Here are the products I have on affected clients: 

- McAfee Endpoint Security for Mac 10.7.0 (142)

- McAfee Firewall for Mac 10.7.0 (111)

- McAfee Web Control for Mac 10.7.0 (111).

- McAfee Drive Encryption Go 5.1.0.7

- McAfee Native Encryption 5.1.0.7

[gururaj]

hi 

Thanks for the update,  you mean to say the issue is observed on mac os 10.15 catalina only. 

can you validate only installing the ENSMTP (threat Prevention) only and remove all other components and set the scan on write option  enabled and validate.

or option is move to kext less mode and validate. i did not  see the MER..

Regards,

Gururaj.m.d

[Michael89012]

We've been experiencing this issue for a long time with a number of different MacBook builds running various versions of McAfee Endpoint Security administered by EPO.

MacBook Pro 2016

• 2016, 2.9 GHz Dual-Core Intel Core i5
• macOS Catalina: Version 10.15.6

McAfee Endpoint Security for Mac: 10.7.0. (142)

• Threat Prevention
  • Engine Version: 6100.8979
  • DAT Version: 4346.0000
  • DAT Creation Date: 8/31/20
• Web Control
  • Version: 10.7.0 (111)
• Adaptive Threat Protection
  • Version: 10.7.0 (128)

We are also running disk encryption using FileVault (I suspect that is a factor).

The issue arises after the MBP comes out of sleep mode. Any application that reads from the disk is severely hampered, like OP mentioned, from 1-2 minutes. This includes web browsers, Office applications, and even the terminal when it reads from the HDD. Applications like Remote Desktop that is less reliant on the HDD operate at normal after a slow startup.

The Agent reports Threat Prevention is not running, while the other components are. It seems like Threat Prevention is trying to read from the disk, getting locked up, and then monopolizes all HDD access, even to the point where I can't even shutdown the MPB gracefully. I suspect that it is not playing well with the FileVault DE. Unfortunately, DE is a requirement because of sensitive customer data, which also makes AV a requirement.

The only way to recover is a reboot, and like I mentioned earlier, it's a forced shutdown (luckily macOS can take a good beating).

These slow downs are obviously taking their toll on our users, more sore when they are traveling since that is when their MBP's will go in and out of sleep mode.

[gururaj]

Hi,

We are also running disk encryption using FileVault , is using McAfee product ? 

(I suspect that is a factor). it may be because the once the system to go sleep. or other process function are standby.  if possible on one machine disable the encryption  and validate. 

second after disable the encryption if issue still persist then disable the Adaptive Threat Protection and validate.

the above test to isolate which component is causing the problem.

Regards,

Gururaj.m.d