a complete re-installation and deleting of McAfee didn't sole that problem. I analyzed the crash minidump file and found the following red marked processes:
So we are analyzing. I also found some crash information regarding HpqKbFiltr.sys in the WEB. That is a very old source file from 2009. May be that is the reoson for crashing?
On a few clients I've this problem too. But in my case BSOD appears at PC's startup. At the moment where you can see the icon of Windows 7.
The quickest and best way to resolve this issue is to get a full or kernel dump when reproducing the issue to be analyzed by McAfee support. They may give you the solution or may be they need to escalate the case to a higher tier to be investigated.
Are you using patch 4? We had similar issues with a server hanging after several strange scan failures. It would simply crash VSE when scanning a basic autorun.inf file. After VSE had restarted a number of times, the server would hang. I was told that P4 has issues. We reverted to P2 and all was fine.
I know it may sound strange but also check your policies for VSE. If you are not using Low-Risk process exclusions and you haven't provided the basic McAfee processes recommended in the VSE 8.8 Best Practice Guide for Low-Risk...you may have McAfee stepping on itself with the On-Access Scanner during the system shutdown. Also, providing the Low-Risk exclusions will keep McAfee from impacting system performance as much as I'm guessing you're experiencing.
A good thing to remember is that each McAfee solution you add (Host IPS, Policy Auditor, Encryption, etc.) will also require a little adjusting to the VSE On-Access Low-Risk Scanner settings. This will also help to keep additional McAfee solutions from impacting system performance and potentially creating new (although similar) problems.
If you want some additional assistance, message me and perhaps I can setup a free ePO Healthcheck for you.
Hope this helps,
After you uninstall and reinstall VSE, did you get the Blue Screen on the very next restart?
I bet you have custom VSE policies in your environment, right? So I would suggest that you uninstall and reinstall VSE and this time do not use any of your custom VSE policies (just use the default VSE policies in ePO) and see it you still get the Blue Screen.
We had similar situation in our environment, we sent MER logs and dumps but McAfee support could not figure it out. Finally, we found out that the blue screen was caused by the one of our VSE policy.
thanks for Information. It's a crazy solution in my opinion. We are unsing thousends of EPO clients with VSE installed and custom VSE policies configured in our environment. But only one or two machines had that issue. I can't believe that one VSE policy setting is the reason for that issue because all other machines are working well.
The problem is gone for now after OS reinstallation of that problem machine. A reinstallation of the McAfee software didn't solve that problem.