Black screen on Windows 10 VMs with ENS 10.5.5

[jess_arman]

@NikolayE Would you be able to provide me with the SR number so I can look into the case and see what I am able to do in order to get you the traction you need?

EDIT: I see you've provided it in a different response. Thank you. I'll follow up.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[NikolayE]

Thanks. Just as a side note.... I even tried to apply default McAfee Exploit Preventiton policy just in case mine was corrupt. Same result.

[jess_arman]

@NikolayE We've had some discussion with the technician working on your case and have assisted with some review of the logging and issue, and they should be reaching out to you with some additional next steps and plan for investigation.

[Former Member]

We're experiencing this as well, on a physical Windows 8.1 laptop. As soon as ENS gets installed, all user GUI dissappears and user only has an unusable black screen. After uninstalling ENS, and starting explorer.exe, everything is fine again.

[NikolayE · Accepted solution]

We identified and resolved the problem. It was caused by 3rd party antimalware product called "Crowdstrike" which was colliding with McAfee exploit prevention. We modified one of the "Crowdstrike" policies to resolve the problem.

[Former Member]

Thanks. We're not using any other security products though.

[stevenheritage]

This appeared to be my issue as well.  A specific CrowdStrike Sensor update caused the issue.  

Curiously enough, an update to McAfee ENS 10.6.1 December Update corrected the issue.

[Captainmark1]

Can you tell us what you changed in Crowdstrike to fix this 

[NikolayE]

Disable - Additional User Mode Data in Crowdstrike

[stevenheritage]

I'm seeing this issue as well; however, I'm seeing it primarily on physical machines.  

The issue is first noticed as Internet Explorer or another browser not launching on a computer.  When the user restarts, they typically do not have the GUI desktop upon Windows logon (the shell, explorer.exe, will not run).  We can launch Task Manager and run a new task (either explorer.exe or iexplore.exe) and watch the process spawn, but die very quickly.  Exploit Prevention (and ENS as a whole) is not logging any threats or blocks, but when we disable Exploit Prevention (via policy update in ePO), the issue is no longer present.  Because a threat or block is not logged, I can not pin this on any specific ID.  I have an open SR, but Support has not been helpful and appears to not have even reviewed the MER or logs that I have sent in.

Reviewing the Debug log for Exploit Prevention, I can see several Warnings when I try to spawn the iexplore or explorer process:
12/19/2018 10:08:00.443 AM mfetp(7628.1928) <SYSTEM> TmpLogger.Gbop.Debug: [s] Warn : 0x1dcc,788 AddJobEx: pid 0x3058, Already in the job map with job state 0x1

Additionally, there are occasional errors in the debug log as well: 

12/19/2018 10:08:00.486 AM mfetp(7628.2672) <SYSTEM> TmpLogger.Gbop.Debug: [s] Error: 0x1dcc,a70 Error: HamQ error code: 0xd

Updates to ENS and McAfee Agent do not correct the issue.

MA: 5.5.1.388

ENS: 10.6.1

OS: Windows 10 v 1803 & 1809