Windows notification reports ENS is disabled/out of date, but ENS is turned on and up to date

[markgarza]

Hi, I have some Windows 10 machines on 1809 that keep getting a Windows notification that McAfee ENS is turned off (windows notification.png) but if I look at ENS all modules are enabled properly (mcafee on but error in windows defender.png). If I click on the notification, I see the red text saying that McAfee is turned off, and when Turn On is clicked the message goes away. 

This would be more of an annoyance than an issue usually, but it can cause issues when users try to drag emails from Outlook into other programs, which many of them do. It gives them an error saying the anti-virus is out of date:

and is fixed by clicking the Turn On button in the Security Providers screen after clicking that Windows notification. Some sort of miscommunication between Windows Defender and ENS. 

Agent version is 5.6.1.308

ENS platform version is 10.6.1607

Affects Windows 10 feature update 1809.  

Should I open a case for this? I notice that others are running into the same issue, though not sure if it's causing actual problems for them. 

[patrakshar]

There is another discussion going on for the similar issue.
https://community.mcafee.com/t5/Endpoint-Security-ENS/Windows-10-fails-to-detect-McAfee-ENS-10-6-1-r...

[AdithyanT]

Hi @markgarza ,

Firstly, Thank you for your post. The severity of the issue depends on the outcome of the below steps:

1. Please ensure OAS is turned ON on the endpoint.
2. Download an EICAR test file.
3. Please confirm which product is detecting the EICAR test file.

If the detection pops up from Endpoint Security, I am fairly confident that we are dealing with a false alert from Windows Security Center here.

If the detection is form Windows Defender AV, This issue must be treated with a higher priority and may be more than just a cosmetic issue.

On Either cases, we would recommend creating a Service Request with us to investigate further on this.

Also, I am interested to know value of DWORD "State" under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{1006DC03-1FB1-9E52-7C81-F2FAB48962E3}.

Kindly please keep us posted on the Service Request Number as well (in private chat if you do  not prefer posting it here) and I shall keep a watch on the same.

[AdamDJ]

The same issue is occurring for me, after upgrading to the 10_6_1_1340_1_standalone_client_install that was recently released by McAfee (this installs/upgrades to ENS 10.6.1.1607). I have installed this update on three other machines, and the same issue is happening for each one. All clients are running Windows 10 version 1903. I think a case needs to be opened for this, if it has not already. The issue is this: every day Windows will display a notification that both McAfee and Security Essentials are turned off. However, reviewing the McAfee status shows that all features are running, and even the Microsoft security center shows that McAfee is turned on. It appears to be a false message that occurs once daily (or once per logged-in session).

[AdithyanT · Accepted solution]

Hi @AdamDJ 

Thank you for your kind response to this post. You are very correct in thinking about raising a case. I am fairly confident that in your specific situation this is a cosmetic issue, however I have recently been coming across other variations of this issue (Windows Defender enabled and ENS actually disabled), Windows Defender Service crashing from time to time, etc). Here are some frequently asked questions that we can look into:

How do I confirm if my issue is merely cosmetic?

Firstly, we would look into Security Center and confirm that it displays ENS is turned on and running and Windows Defender stays off or disabled. You can also open ENS console and confirm Threat Prevention status over there.

How do I know I am protected by ENS?

The best way to confirm that would be to run an EICAR test. If you get the test file captured by ENS, then that is a solid confirmation that ENS is protecting you effectively.

What is happening here?

Essentially, if the above tests confirm that this is cosmetic issue, and I would like to really stress upon that the below statement is applicable only in this scenario, We are seeing this Windows 10 toast notification from Action Center every time you perofrm a 

1. Login
2. Reboot/Boot
3. Policy enforcement manually
4. Changes to policy/configuration (opening client UI and changing any settings under Threat prevention - even enabling a feature)

During all of the above situations, a refresh of configuration takes place and this momentary change triggers this notification from Action Center.

Having said this, this issue is being dealt with priority by our development team and we are certainly working on this towards a resolution. I would still strongly recommend raising a support request with us due to the following reasons:

1. Growing variations of the issue ranging between cosmetic to functional issues.
2. Access to a early fix (Release to Support/POC) package if a fix is released and being tested out early before being released globally.
3. Confirm if the issue is same as identified in previous scenarios. If it is different in any manner, it requires a separate fix from our Engineering team.

Kindly please help us by raising a Service Request and we will be very glad to assist you on this as swift as we can. Please note: Although we register fine during installation with Security Center, we have noticed that Windows Defender and its security Center seems to have some incompatibility in displaying the correct information even after ENS getting turned ON, which essentially should clear off the notification, however it does not! I would certainly refrain from the blame game here, but I sincerely hope we will be back with an update on the fix sooner than expected.