4 Replies Latest reply on Aug 12, 2017 11:47 AM by mshipp

    ENS 10.5.1 Fails at Start-Up

    mshipp

      I have been battling an issue with ENS 10.5.1 (w/ ATP 10.5.1) since I began testing it some months ago. We are experiencing an issue where ENS randomly fails to start at boot. Symptoms include the McAfee tray icon failing to appear in the System Tray and the mfetp.exe process will start and stop every so often. When the issue occurs, ENS is NOT protecting the system, and no detection's occur. The ENS Console cannot be opened (MFEConsole.exe). On systems that have Web Control installed, when the issue occurs, Internet Explorer and Firefox will not load either (mfewc.exe fails). The only workaround thus far is rebooting the system over and over until ENS successfully starts up. Sometimes it's 1 reboot, sometimes it's 4-5 reboots. This issue has me stuck at ENS 10.2.

       

      System Profile:

      Windows 7 x64 Enterprise

      HP EliteBook 840 G3

      ENS 10.5.1/10.5.2 (Threat Prevention, Firewall, Web Control, ATP, DXL, Active Response)

       

      I have a SR open and have provided somewhere in the range of 60GB of MER's, Procmon dumps, memory dumps, and Windows Performance Recorder dumps. I have also done a P2V of an affected system and provided a VM to McAfee. So far no fix has been found. Most recently, they recommended that I install MS Patch KB3092627 (KB3092627), which I did and does not seem to have resolved the problem.

       

      Has anyone experienced any issues like that at all? Any thoughts or recommendations for troubleshooting?

        • 1. Re: ENS 10.5.1 Fails at Start-Up
          Solu enu

          Hi,

          I'm having exact same issue. let me know if you find any solutions.

          Thanks.

          • 2. Re: ENS 10.5.1 Fails at Start-Up
            mshipp

            It appears we have finally found a solution. As of today I haven't seen the random startup issue occur on any of the test systems after applying the fix. In our case, it was related to a missing Microsoft Patch from 2015.

             

            Below are the notes I received from the McAfee Dev team.

             

            Dev Team Notes:

            We opened a case with Microsoft on the deadlock that is in the dump that was previously provided by the customer. Their analysis is that KB3092627 should be installed as it addresses the cause of this deadlock. Please have the customer install KB3092627 to see if it resolves their issue.

             

            Here is the full Microsoft response which should be provided to the customer:

             

            Issue Summary & Action Plan

             


             

            The reported symptoms are being caused by a regression in MSXML that was introduced by security patch (MS15-084 a.k.a KB3076895). This issue has been fixed via KB3092627.

             

            Action Plan

            • Install the fix from KB3092627
            • Reboot the machine
            • Test to confirm this resolves the issue
            • This patch should be deployed to any/all machines that have MS15-084 (KB3076895) installed
            • 3. Re: ENS 10.5.1 Fails at Start-Up
              Solu enu

              Thanks for your reply. I also have opened a ticket with McAfee yesterday and waiting on their reposne. In your original posting (below) you mentioned that it didn't fix the issue even after applying the KB, and now you're saying solution is to install the KB. is that correct?

               

              -------------------------------------------------------------------------------- ---------------------------------------------------------------------------

              Most recently, they recommended that I install MS Patch KB3092627 (KB3092627), which I did and does not seem to have resolved the problem.

              -------------------------------------------------------------------------------- -------------------------------------------------------------------------------

              • 4. Re: ENS 10.5.1 Fails at Start-Up
                mshipp

                Yes, it does seem that the patch has resolved the issue and the problems I saw after applying it were anomalous.