1 Reply Latest reply on Oct 2, 2017 6:17 AM by chrisnlc

    ENS Threat Prevention 10.5.1.1294 causing lag when opening windows applications

    yostie

      Hi,

       

      We have a system that is running ENS Threat Prevention 10.5.1.129, which is managed by ePO 5.3.  We are currently in the process of finalising a master image; however we are having performance issues when ENS Threat Prevention is installed.  What happens, is when the computer boots, when you try and open some windows base applications such as Device Manager, there will be a 5-10 second lag until the application opens.  Once the application has been opened at least once, then it opens quickly after that until the computer is restarted.  Sometimes some application will open fine, but other times they will not.  The lag only occurs with windows own built in applications, and has been noticed when opening things such as Device Manager, Task Sched, Remote Settings, Explorer and sometimes even just right clicking on the desktop.  The issues is definitely related to ENS TP, as when it is uninstalled the problem goes away.  Any help would be greatly appreciated.

       

       

      Workstation: Dell M7510

      Operating System: Windows 7 SP1 64-bit

       

      Installed McAfee Products

      Benchmark Editor Multi Platform Scan Engine:  6.2.2.146

      ENS TP 10.5.1.1294

      ENS FW 10.5.1.1075

      ENS Security Platform 10.5.11216

      Agent 5.0.5.658

      PAA 6.2.2.146

      SolidCore 8.0.0.651

       

      Cheers

       

      Simon

        • 1. Re: ENS Threat Prevention 10.5.1.1294 causing lag when opening windows applications
          chrisnlc

          Your first port of call should be process monitor. Start capture, open an app, wait while the laggy issue occurs, then stop capture when the app appears.

          Now you can comb through the app's history to see what it was doing.

          To me this sounds like a timeout occured on one of the app's operations like check for internet connx or a file server connection. After the first use a cached response is used. Just a hunch anyway and not obvious why TP causes it.

           

          Normally the answer is within the procmon capture.

           

          _Chris.