Endpoint Protection

Hi everyone
 

I have this weird problem and was wondering if anyone had any ideas where to go next.

In short, when I access network share EXE files get locked. If I try deleting any EXE (from Windows Explorer for example) it dissappears for a couple of seconds (or until Refresh) and then reappears. Cannot move it, cannot rename it. Only when I logoff (and, I guess, network connections get cut off) files are deleted.

If I try deleting these files locally (on the computer hosting network share) I get "File access denied" error. Unlocker/IObit Unlocker both report file(s) not in use, but cannot delete them, only after unlocking with Open File List utility (OFL.exe) file(s) can be deleted locally. Sometimes even OFL cannot unlock them, for example if I try deleting/refreshing few times.

Went through network share permissions/ACLs first, although nothing was changed to trigger this. Tried couple of other things, but only after CleanWipe-ing this particular computer (my admin workstation) things went back to normal. SEP client reinstallation reintroduced the issue. I tried to vary policies, our standard, SEP default, all off, tried unmanaged, tried disabling everything possible and its always the same. After that I went with second CleanWipe with thorough registry clean. Reinstalled the client, nothing is changed.

As far as I tested, none of the other SEP clients/LAN computers are affected. This one has fully updated Windows 7 Pro, 14.2 MP1 client, nothing (related to this) in Windows logs, nothing in SEP logs. I think this started happening with 14.2, but cannot say for sure.

Anyone has any idea? Seen something like this before?

Regards

Haven't heard or seen this yet on the forum but with 14.2 it may be best to just get a case opened up. Works fine without SEP installed?

Yes Brian, described above is not happening when SEP is uninstalled.

It's my workstation, I use it to test pretty much everything and something somewhere went sideways, obviously. But as there is a tonne of software on it I would REALLY like to avoid reinstalling everything. What's more, it is not that big of an issue, I have couple more machines next to me, could use them to access network shares, so I could learn to live with it. But it's kind of annoying, you know.

Just wanted to aks here if anyone maybe encountered anything similar.

Thank you

Depending the amount of time you have and work that you want to put in, start by installing the AV component only. Then add back each component one by one until the problem appears. This should at least narrow it down.

I guess the other thing would be is to ensure you're running the latest version, 14.2 MP1, which just came out a couple weeks ago. Not sure what you're on but just another suggestion.

Brian

I'm running v14.2.1015.1000 on all compatible machines including affected one (still have 3 old servers and 6 even older, but irreplaceable workstations running v12 RU6 MP10), all managed by 14.2 MP1 SEPM.

Will try as you suggested, thanks

Since it's the latest version it could be a bug, but, I'm not sure. Haven't seen it yet but we're still testing this version.

It was Application Hardening. No issue with client in below configuration.

Thank you Brian

Which requires different licensing to use so probably not a big deal to remove in your case. Hopefully someone from support see's this though as it's an issue.