Windows 10 fails to detect McAfee ENS 10.6.1 running and Windows Defender kicks in

[Former Member]

Great, thank you! I have reached out to the assigned engineer and have advised on what needs to be gathered / checked so we can escalate to engineering. Your case is actually interesting because it's 1809 builds. So far I've only seen 1903 builds being affected.

I'm glad to hear you've found a temporary solution even though it may not be useful for long. If we find anything better to use, I will update this thread.

[kylekat]

@Former Member I am not sure I u derstand why you say that 1809 is a novelty. When I started this very post I was not deploying May feature update yet and that is why I complained to support that the claim of "ens MAY update has been fixed" is utter nonsense. I have seen this with any combination of ens July or may update as well as with or without May feature upgrade for windows 10. 

It certainly became much worse once May Feature Upgrade started being released in my environments, but issue was there from before.

[Former Member]

Only because so far via Technical Support I've only seen reports of 1903 machines being affected. It's slightly different to the known issue we saw and fixed with the May Update. The problem is (not passing blame here at all but just stating it) Microsoft keep changing their integration methods with the Security Center and this leaves us chasing after their changes to get ours integrated properly, this is why this keeps reappearing in different variations. Anyway, let's make sure the remote with you happens so we can get the data to engineering. I know they are talking about releasing a POC so if we can get yours to engineering, you'll be given access to this once it becomes available.

[SteveWilkinson]

We have this on over 150 clients, they are majority 1809 (few 1803!)

[SWISS]

"Only because so far via Technical Support I've only seen reports of 1903 machines"

Also happens on:

Windows 10 ENTERPRISE LTSC, 1809, BUILD 17763.592, EN, German MUI

[SteveWilkinson]

my colleague created an SCCM query to identify them; get-mpcomputerstatus|select realtimeprotectionenabled

[billmoller]

@Former Member, to be clear, at least for me re: KB91830; the issue is not "intermittent."  KB91830 might need to be updated (unless I'm the only one experiencing this in a non-"intermittent" fashion).

In my case, ENS always shows as OFF. 

WSC does "intermittently" notify me that no anti-virus is enabled, but only because Windows Defender Antivirus seems to crash frequently now with "Threat service has stopped.  Restart it now."

I believe it's crashing because the two AV services (WDA and ENS) are conflicting.

Can anyone else comment on whether the issue is "intermittent" for them, as KB98130 indicates?  i.e. whether ENS is "intermittently" off vs. WSC "intermittently" reporting that ENS is off?

Since this issue started, ENS has never showed ON for me (unless I click the provider and click the "Turn On" button, which doesn't seem to do anything, because ENS is already on, and doesn't survive a reboot).

[SWISS]

McAfee Partner with over 30 EPO installations.

Windows 10 ENTERPRISE LTSC, 1809, BUILD 17763.592, EN, German MUI

FRESH Install 10.6.1 JULY OR migrated from ENS 10.6.1 MAY 

* McAfee DXL Client  5.0.1.249   
* Endpoint Security Adaptive Threat Protection  10.6.1.1421   
* Endpoint Security Threat Prevention  10.6.1.1666   
* Endpoint Security Platform  10.6.1.1607  
* Agent  5.6.1.308  

* EPO 5.9.1, all Hotfixes

Procedure to force ERROR (Satte that two AV are running)

1) Deploye Comes with Agent 5.6.1.308 and ENS as above

2) All is fine "2 x Windows Defender Antivirus Service DOWN", "1 x Windows Defender Firewall UP"

3) REBOOT

4) Windows 10 DOES not SEE MCAFEE and THUS makes Windows Defender active

5) STATE ENS 10.6.1 all MODULES and Windows Defender AT SAME TIME RUN and SLOW down performance.

6) If you TAKE down the MCAFEE ON ACCESS SCAN > Windows Sees it and shut out, If you turn on ACCESSS SCAN all is fine again.

7) Reboot SAME from starting

This is a major Problem please resolve ASAP.

[Former Member]

I can only repeat myself. Please raise a Service Request so we can work with you to gather appropriate data and can escalate to engineering swiftly. As I've said in previous answers, I know Engineering already have a few reports (so far only 1903 but based on the responses here it seems other builds are also affected) and I can advise that Engineering are already working on a fix. Once your SR is with Engineering we would be able to provide a POC once available to confirm that we'll be fixing your issue in the next release as expected.

[SWISS]

Service Requests 4-20295857151

McAfee, partners other people with the same problem:

Please post the information and possible HOTFIX availability right here.