Windows Update - Server 2016 - Problem DeepGuard and Real-Time-Scanning

Hello,

In the course of the Windows Server 2016 - changeover I increasingly notice that the monthly cumulative updates fail, mostly with this error code 0x800705b4. The error code seems to be a TIMEOUT from Windows Update according to internet research.
There are many workarounds on the internet for troubleshooting.

After some testing I noticed that if I switch off the real-time scanning and the DeepGuard, the update process is completed much faster and successfully.
With activated DeepGuard and real-time scanning the installation usually fails and takes 2-3 hours.
With DeepGuard deactivated and real-time scanning - installation successful and takes 30min.
I have tested this variant with servers that get their Windows updates via the internal WSUS and install the updates normally via the menu function.

However, I have also tried other methods, where I also managed a successful installation of the updates with activated F-Secure.
Starting the Windows tool "sconfig" via an administrative cmd and installing Windows updates via it also led to success, but takes over 5h.
Furthermore, I downloaded the monthly update as a .msu file directly from Microsoft and then installed it manually, which also led to success. This took more than 4 hours and is of course not very effective.

In summary, you can say that F-Secure slows down the Microsoft update process on servers enormously or the update fails because of the timeout.

F-Secure Server Security Premium 12.11 is installed on the servers.

Can you trace or reproduce the above processes and do you have a solution?

Thank you very much for your help.

Stefan Schmidt

Find more posts tagged with

Comments

madhuDm

Instances created from Windows Server 2016 and later Amazon Machine Images (AMIs) use the EC2Launch service for a variety of startup tasks, including initializing EBS volumes. By default, EC2Launch does not initialize secondary volumes. You can configure EC2Launch to initialize these disks automatically. https://onlineitguru.com/aws-training.html

Bulbous

Looks like the Hotfix can be pushed out in bulk using "Policy Based Installations".

Bulbous

I would like to know as well. How can we push the hotfix to hundreds of servers?

MJ-perComp

@Vad
when will the hotfix be pushed to SS12 and PSB via updates?

RmB

I'd like to inform that same hotfix works also PSB Server Security product as there is same kind of problems with MS patches.

Zoltar

Just to add to our experience of the new 19 February patch to fix the slowness during the Microsoft Patching:-

The greatly improves installation + reboot times for Windows 2016 servers were achieved WITHOUT the needs for any special directory, file or process exclusions that have been mentioned by other contributors to this post.

Zoltar

The new hotfix released by F-Secure on 19 February for Server Security (FSAV952-10) says it fixes the slowness during the Microsoft Patch installation.

Well it does!

On Windows 2016 servers the difference it makes is remarkable.

On some initial testing I did an install of the latest Cumulative update on two identical servers.

One server had the new patch FSAV952-10 installed.

Server 1 – FSAV952-10 Patched – Total Install + reboot time = 48 minutes
Server 2 – Not Patched - Total Install + reboot time = 4 hours 45 min minutes

Still to test on Window 2012 servers, but to be honest we did not experience any issues with extended patching times. All our issues were with Windows 2016 servers.

Vad

Hello SURFsara,

Do the exclusions mentioned earlier fix it?

Best regards,

Vad

SURFsara

I have installed the "F-Secure Server Security Premium 12.x FSAV Hotfix"

- The new: "2019-02 Cumulative Update for Windows Server 2016 for x64-based Systems (KB4487006)" still takes hours.

It's not fixing our problem.

Vad

No, they are not needed if you have the hotfix installed.

Best regards,

Vad

Martdl

Tried the hotfix on two new deployed machines. One with hotfix, one without.

Server with hotfix is ready installing updates after 32 minutes.

Server without hotfix is still busy after > 99 minutes.

So i think i can safely conclude the hotfix makes a difference. I'll be deploying it asap.

One last question, are the exclusions mentioned above still necessary?

Vad

Hello Solipsis-VdP,

The solution (hotfix) is already available. Did you try it? If not, just contact support, and we will provide it to you.

Best regards,

Vad

Solipsis-VdP

I'm glad my colleague found this thread.

This issue has been costing us many (expensive) hours and frustration during downtime.

Please provide a proper solution with high priority (product update)!

Thanks.

Martdl

@ITMSuhl wrote:
Did the excluded paths also reach the agent?

Yes, checked that before i started the updates.
I'm letting this rest now, monday is our production patching, so i'm not going to change any more and just disable f-secure on all servers.
After that i will open a case with F-secure.

I just heard from our Desktop team that they also experience problems with Windows 10 clients.

Vad

Hello everybody,

The new hotfix was created yesterday. Not yet available on the web site. Please, contact support, and they will provide it to you.

The hotfix is applicable to 12.x Server Security/Email and Server Security and Client Security. The hotfix id for the reference is FSAV952-10.

Best regards,

Vad

ITMSuhl

Did the excluded paths also reach the agent?

Martdl

@Martdl wrote:
@Henrik4 Yes, we have more exclusions set. According to F-secure documentation the * shouldn't be needed. I've made the change and am testing now to see if there's a improvement.....

Well, that didn't work.

2 NEW Windows server 2016 systems deployed with F-secure Server Security 12.12 with hotfixes.

Disabled all F-secure services on one system. Downloaded all updates on both systems, same set, and started the update process. The Server with F-secure disabled is ready to go and rebooted within the hour (43 minutes). The second system is still busy "Getting Windows Ready, Don't turn off your computer" after 107 minutes.

I'm done, going home now, but this is not working....

Martdl

@ITMSuhl The problem isn't the distribution but the updates are taking far longer than usual. Normally a server is up and running again within an hour, now there are systems that are busy for > 4 hours. especially the reboots are taking much longer.

Running PMS 13.11.84108

SS clients: 12.12 with FSAV952-09 and FSMA1010-HF03 hotfixes

ESS clients 12.12 with FSMA1010-HF03 hotfix

ITMSuhl

Please differentiate Client and Server version

Client = V14
Server = V12

https://www.f-secure.com/en/web/business_global/downloads/server-security

We didn't put the asterisk behind it and successfully distributed the January updates on Server 2016

DavidCES

There arent any hotfixes available for Client Security. I cant even find the downloads for v 12 as I believe its end of life.

Martdl

@Henrik4 Yes, we have more exclusions set. According to F-secure documentation the * shouldn't be needed. I've made the change and am testing now to see if there's a improvement.....

Henrik4

@Martdl Im not sure if the * is needed, but it seems to work for us.

Did you set 'Excluded Objects Enabled = Enabled' setting?

Martdl

Is the * after the directorys needed? I've used this format: https://community.f-secure.com/t5/Business/Excluding-objects-from-Real-Time/ta-p/66013
And it doesn't make a difference.

Henrik4

@ITMSuhl wrote:
Answer from F-Secure-Support from Finland

I've have a direct solution of the problems, you can be can be be be prepared for subsequent solutions, in the Echtzeit-Scan folgende Pfade ausschließen
C:\Windows\WinSxSxS\
C:\System Volume Information\
C:\Windows\SoftwareDistribution\

In Q1/Q2 this year an ultralight version for servers will be released, which skips all possible IO's --> I don't think it's so good now either
Excluding the above mentioned paths at least leads to a successful installation of Windows Updates at Server 2016.

Greetz

This solution seems to work for us aswell.

This is how i configured it:

Fsecure policy manager settings

Policy manager version 13.12.841

Vad

Hello Martdl, DavidCES,

We have a hotfix now, which helps to resolve the issue for one of our customers. Please, contact support.

Best regards,

Vad

Martdl

That doesn't make any difference. Fix this please, we are currently disabling our SS products on servers during WSUS rounds.

DavidCES

Also have this problem on Windows 10.

We use CS 12.

Does the same problem occur with newer versions of CS?

Vad

Hello Martdl,

The only solution we have currently is the set of exclusions mentioned in the comment posted before yours.

Best regards,

Vad

Martdl

Any news on this?

There is no improvement noticable on our Server 2016 systems. With F-secure enabled the update process is taking forever, stop all f-secure services and the server updates within an hour including reboots. A Server with F-secure enabled is taking over two hours updating.

The new Capricorn engine makes no difference in the update process.

ITMSuhl

Answer from F-Secure-Support from Finland

I've have a direct solution of the problems, you can be can be be be prepared for subsequent solutions, in the Echtzeit-Scan folgende Pfade ausschließen
C:\Windows\WinSxSxS\
C:\System Volume Information\
C:\Windows\SoftwareDistribution\

In Q1/Q2 this year an ultralight version for servers will be released, which skips all possible IO's --> I don't think it's so good now either

Excluding the above mentioned paths at least leads to a successful installation of Windows Updates at Server 2016.

Greetz