Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

[kylekat]

Widows 10 fails to detect McAfee ENS 10.6.1 running and windows defender kicks in. This is affecting us due to the fact that our VPN client does a host check and will only allow systems through if McAfee is running and definitions are up to date.

If we click "Turn On", that is all it takes to fix the issue and VPN connection works normally, but after a couple restarts, the system will revert to this state again forcing the user to manually hit "Turn ON".

All ENS modules look "enabled" in the console and there arent any other indications of an issue other than Windows Defender being turned ON and the "security providers" showing that shown in the screenshot.

Windows Version 10.0.17763 Build 17763
OS Name Microsoft Windows 10 Pro

ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)
Platform: 10.6.1.1555
Threat prevention: 10.6.1.1638

This wasn't happening before and wondering if other people are seeing the same and if there is a solution.

[Former Member]

Could you confirm the exact OS and ENS version installed?

[kylekat]

Thank you @Former Member 

Windows Version 10.0.17763 Build 17763
OS Name Microsoft Windows 10 Pro

ENS 10.6.1 July Update (but also observed in vanilla 10.6.1)
Platform: 10.6.1.1555
Threat prevention: 10.6.1.1638

[Former Member]

Great thanks!

https://kc.mcafee.com/corporate/index?page=content&id=KB91428 >> we did fix this in the May Update so you should definitely not be seeing it with the July Update.

To help us expedite and troubleshoot this, kindly raise a service request with support. If possible provide the following data to get it reviewed as quickly as possible:

Set debug logging for all ENS modules.
Set amtrace and procmon to log at boot. See KB86691 for parameters.
Restart the system.
Open WSC and check status. Stop amtrace and procmon.
Collect MER, amtrace, and procmon log.

Get the output of the command below; run with Admin CMD prompt:
powershell Get-WmiObject -Namespace "root\SecurityCenter2" -Class "AntiVirusProduct"

[kylekat]

there goes half of my day for the next two weeks.... Like every time I have to work with support and collect random logs. This issue is intermittent, it is not occurring 100% of the time......

I'll try to collect all that stuff when i have time.

[Former Member]

I'd like to save you the hassle and collect this myself but my test machine is not displaying this same behaviour. Sorry!

[kylekat]

@Former MemberThis issue seems to be ramping up dramatically with my deployment of the July update repost version of ENS in combination with Windows 10 1903 may feature upgrade installation.

I will try to capture the plethora of logs you asked and create a ticket but its quite ridiculous that McAfee cannot work on this on their own.

Endpoint Security Threat Prevention 10.6.1.1666
Endpoint Security Firewall 10.6.1.1340
Endpoint Security Platform 10.6.1.1607
Endpoint Security Web Control 10.6.1.1435
Endpoint Security Adaptive Threat Protection 10.6.1.1421

[Former Member]

Hey Kyle, I would happily work on this with data collected from my own machine but the problem is, I haven't been able to replicate this behaviour on my 1903 test machine yet. Appreciate your assistance to get this looked into.

[AdithyanT]

Hi @kylekat ,

Firstly, Thank you for all the effort and time you are investing into this. I certainly agree that this activity of log collection and uploading them to the Service Request is exhausting to you and I really wish I could help you out reducing efforts to none or minimum, unfortunately, I have attempted both upgrade installation (from December installation to May update patch and then apply July repost and I also tried running a clean install of July update and I am unable to re produce the issue from my end. However, I have just come across another McAfee User I am working with who has this issue.

However, I am fairly confident this is a Cosmetic issue and would like to confirm it with only one step - an EICAR test. This should let us know why Windows Security Center is displaying the information this way.

Also, Can you please help me with value displayed in this key(if it exists)?

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}

If the "STATE" DWORD is any value other than 397312, Please do let me know so that I can confirm the issue is same.

These 2 steps as stated above should give us a confirmation whether the issue is cosmetic or if it is affecting the product's functionality.

Also, If these values match, I will be checking this from my end with the Engineering team with the helps of logs I have collected from my client and see their recommendations are useful to you as well.

We really look forward to your kind response on this and my goal is to ensure you put minimal effort from your end considering you having tested out several scenarios already from your end. In case the information you provided does not match with what I have observed form the ticket I am already working on,then, I am afraid we may have to create a new ticket for you with all the required logs.

[kylekat]

Thank you @AdithyanT and @Former Member. I uplaoded more evidence to my ticket i've sent via private message, but here are some answers:

I did an eicar test file on a system experiencing the problem and it looks like Windows Defender blocked it instead of mcafee.

And the regkey: