Windows Defender Endpoint

Hi Kerry, we have TWO sites where we have sporadic printing issues, where it will print say a sales order out with the wrong name & address. Its always the same accounts name & address as the header eg "write off account". Weve checked all the usual ** AUTO ** docs, ran UDS with force rebuild....someone mentioned HP Wolf security being the issue, so we asked both sites to confirm this was not being used

And both sites use Microsoft WIndows Defender Endpoint & nothing else!!! One site has switched this off completely for a day & we have had no reported errors. they will siwtch it back on tomorrow, as naturally they didnt want the server exposed for such an amount of time, but this printing issue doesnt happen all the time.

Just interesting they dont have this Wolf security, but both do have Msoft Endpoint!!!

thanks

James

kerryh

Hi James

We have a separate site with this problem on Purchase Orders which we've been in discussions with on here. It always uses the header information from the first purchase order in dohead. As a test we deleted the first order, reorganised and its moved on to the next po that is now top of the list

With have double checked with them today to see if Defender is installed anywhere as it began with one user often having the problem, one intermittently and one not at all until a couple of weeks ago. They have advised they are using Cynet

Both are sites we don't support the hardware
etwork and not easy to gain access. The site mentioned originally are currently getting problems in differerent areas daily since Defender installed

Kerry

fzw

HI Kerry

I have/had two sites with Windows Defender. The first site refused to believe Windows Defender was an issue but eight months later (and crashing multiple times a day/week) they finally relented and installed ESET as their UK head office used this and since then we have had no issues at all.

The other site has only recently started to have problems but it is becoming clear that again Windows Defender is ignoring the exclusions set up. I am trying to persuade them to use a different anti virus. As I doubt logging with Microsoft will have any effect !

Felicity

Had a recent issue onsite with Windows Defender exclusions. It turns out a. Windows update had stopped them working and they had to be reapplied (via Group Policy IIRC)

Hi Kerry,

I have a few sites that are experiencing the very same issue. Can I ask HOW YOU PROVED THAT THE EXCLUDED FILES ARE STILL BEING SCANNED ?

I am trying to prove to the Client that this is where the issue appears to be coming from but their Hardware Support dont want to listen. They just blame the Software.

Thanks

Dermot

claire-craig

Hi Dermot, we have exactly the same situation with a customer - refusing it is Windows Defender and blaming the software. We are currently trying to get them to migrate to our cloud.
If we could prove it is the Windows Defender and get them to change the AV it could save a lot of hassle for them.
Regards
Claire

krys

I am in the same boat - since 17th of April and KB5025221, I have had the same issue on a site where we do not look after the pc's but we do look after the server. Server and RDS have ESET, pc's use Windows Defender. My issues have been PO's randomly display wrong header info (first PO on file), random Error 12's when creating a Sales Order and frx files randomly going missing.

I've reported back that they should reapply the exclusions in group policy.

I'll post again once I know they've done it if it works.

Thanks

Krys

kerryh

Hi Dermot

We were asked to install Opera onto a new server due to issues and could not create a company at all or get UDS to run. We'd seen Promon mentioned a few times here so installed this and proved files were still being scanned

This was reported back to the External IT who then rolled out Defender. Just checked with the internal IT team and they said they used Promon again and could see it was still scanning the files

Hope this helps

Kerry

Thanks Kerry

Has anyone identified a resolution for the defender issues? We have ongoing issues with defender at multiple sites. Any feedback would be appreciated.

We are currently involved with two sites experiencing similar report issues which we are assuming is due to Defender For Endpoint. Excluding Opera files from the traditional antivirus scanner component of this (MSMPENG.EXE) can be done by the customer's IT department but files are still being accessed by MSSENSE.EXE which is a different component that retrieves other information. Currently as far as we are aware only Microsoft can apply exclusions for that at a 365 tenant level so in conjunction with customer IT providers we are trying to get that done.

ianc

We've had similar issues as mentioned above and only fix for us was to move reports locally for every user. This cut out the server (and what I suspect is the AV doing something). Then had zero errors.

ianc

You can use the EICAR file as a dummy virus/malware file. AV should pick this up as a virus, proving that a folder isn't excluded.

Thank you Ian, this is definitely worth trying at the sites experiencing issues with report templates

Hi Ian,

Can I ask what you mean by saying " move reports locally for every user".

Do you mean having a Reports Folder on everyone's PC and changing the Opera.ini file to look locally ?

I have the same issue on 2 sites but haven't been able to get to the bottom of it.

It happens very sporadically and there is nothing I can see to when it happens.

Thanks

Dermot

ianc

Yes, change the .ini file so reports folder is c:
eports (or something) and copy all reports there. It's not ideal, but it "fixed" our problem. I'd do one user first to see it fixes it for them.

Hello Lou, What Pegasus Partner are you with ?

Hi, I'm with HBP/Kamarin

An update on this.

We have an Opera customer who recently implemented Microsoft Endpoint Security and immediately started getting the issues with sporadic incorrect information on PDFs produced from Opera.

Their IT provider has been liaising with Microsoft and the upshot is that Microsoft have enabled a separate 'EDR Exclusions' menu option for their 365 tenant Endpoint Security dashboard, allowing the IT provider to apply exclusions to that (in addition to the normal Defender Antrivirus exclusions)

They also had to push the exclusion configuration changes out on something like a per machine basis as opposed to per network (I don't have the exact terminology) for it to take effect.

The customer has now had 3-4 days without PDF issues.

thanks Alan, this is much appreciated...

0911060553270289.pdf

claire-craig

Thanks Alan, that's very helpful and useful information :-)

Very helpful, thanks for sharing

0911060553270289.pdf

jodie

We also have a customer who was using Windows Defender Endpoint. However, they encountered a large number of issues from reports printing incorrect information, to being unable to run the batch processing due to 'Cannot update the cursor' errors.
They have now reverted back to using Mcaffee but will be looking to implement Windows Defender Endpoint again in the future.
Microsoft were involved but I'm not sure they had much luck getting the additional exclusions put in to prevent MsSense.exe from scanning the Opera files.

Can anyone confirm whether they have had any clients configure Defender successfully after the PCs are onboarded?

Any advice/recommendations would be appreciated.

0712131256598360.doc