| Author | Messages | |
sbradcpa
Posts:496
 | | 10/08/2005 8:59 AM |
| In case you are not aware of McAfee issues on DCs...there's a thread on
Patch Management.org listerve
-------- Original Message --------
Subject: Re: McAfee VirusScan Patch 11
Date: Sat, 08 Oct 2005 10:02:07 -0700
From: Kevin Severud
Reply-To: Patch Management Mailing List
To: Patch Management Mailing List
References:
Couldn't find KB43878 and VSE80P11a.EXE doesn't seem to be publicly
available. It's nice that McAfee mentions this issue in their forums
but it would be nice to get some direct notification. We have at least
one server that has been experiencing this for over a week and have been
spinning our wheels trying to fix it. Now if we could just get that
hotfix...
Some forum posts that discuss this issue:
*Announcement:* Performance issues with patch 11
http://forums.mcafeehelp.com/viewtopic.php?t=56112
Patch 11 performance:
http://forums.mcafeehelp.com/viewtopic.php?t=55935
Pour, Matthew wrote:
KB43878
Environment: McAfee VirusScan Enterprise 8.0i
Environment: Microsoft Windows
Environment: Logon script that loads files from the Distributed File System (DFS) shares
Symptom: Installing Patch 11 leads to increased network activity
Symptom: Logon to Domain controllers intermittently fails
Symptom: Logon to Domain controllers is very slow
Symptom: Security Event log is filled with requests if auditing logon requests
Symptom: Domain Controllers are under high CPU load
Symptom: When clients log on to the domain, LSASS.EXE and possibly DFSSVC.EXE on the Domain controller takes up to 100% CPU time.
Symptom: Network traces on the Domain controller show the following error:
request: NT Get DFS Referral
response: NT error, System, Error, Code = (549)
STATUS_NOT_FOUND
Change: Patch 11 for VirusScan Enterprise 8.0i was deployed to client machines.
Cause:
The symptoms are related to the updated file system filter driver, NAIAVF5X..SYS, but the root cause is unknown and is being investigated by McAfee Engineering.
Fix:
A SuperDAT package, VSE80P11a.EXE, is available from McAfee Support that reinstalls the file-system filter driver from the Patch 10 release.
This is a temporary solution only until the root of this issue is identified and resolved.
As this package installs an older version of the file-system filter driver, the resolved issues of Patch 11 documentation related to the file-system filter driver will not apply.
Note:
With VirusScan Enterprise 8.0i Patch 10 installed, the DFS network trace error appears a few times only (approximately 3-7). With VirusScan Enterprise 8.0i Patch 11 installed, this error can appear several thousand times.
Note:
McAfee fully supports VirusScan Enterprise 8.0i Patch 11 with the VSE80P11a..EXE hotfix package installed.
If you believe you are seeing this issue, please let me know.
-----Original Message-----
From: Michael Swancott [mailto:mswancot@xxxxxxx]
Sent: Friday, October 07, 2005 10:56 AM
To: Patch Management Mailing List
Subject: Re: McAfee VirusScan Patch 11
I spoke with my TAM on this yesterday and Patch 11a is in QA and should be
ready next week.
Michael Swancott
ePO System Administrator
Patch Management
Computer Sciences Corp
BAE SYSTEMS North America
603-748-0351
----------------------------------------------------------------------------------------
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. NOTE: Regardless of content, this e-mail shall not operate to
bind CSC to any order or other contract unless pursuant to explicit written
agreement or government initiative expressly permitting the use of e-mail
for such purpose.
----------------------------------------------------------------------------------------
"Freedman Alan"
@bartsandthelond cc:
on.nhs.uk> Subject: McAfee VirusScan Patch 11
10/07/2005 03:19
AM
Please respond
to "Patch
Management
Mailing List"
We are having major performance issues on domain controllers after
installing Patch 11 for VirusScan Enterprise 8.0i on the clients.
It looks like the problem is caused by the clients running VirusScan
Enterprise 8.0i with Patch 11. The Domain Controller's dfssvc.exe
(Distributed File System) and lsass.exe will take up a huge amount of CPU
usage when clients are logging in and are connected.
This appears to be a known problem for which there's a fix - Patch 11a, but
this isn't generally available.
Alan Freedman
BS 7799 Manager
Dept of ICT
Tel: 020-7377 7046
Fax: 020-7247 8174
-----------------------------------------------------------------------------------------------------------------
The information contained in this message is confidential and is intended
for the addressee only. If you have received this message in error or there
are any problems please notify the originator immediately.
The unauthorised use, disclosure, copying or alteration of this message is
strictly forbidden. This mail and any attachments have been scanned for
viruses prior to leaving Barts & The London NHS Trust network. Barts &
The London NHS Trust will not be liable for direct, special, indirect or
consequential damages arising from alteration of the contents of this
message by a third party or as a result of any virus being passed on.
-----------------------------------------------------------------------------------------------------------------
---
Looking for RSS? The Patchmanagement.org list is available via
http://listserver.patchmanagement.org/read/rss?forum=patchmanagement
PatchManagement.org is hosted by Shavlik Technologies
To unsubscribe send a blank email to
leave-patchmanagement@xxxxxxxxxxxxxxxxxxx
If the above unsubscribe doesn't work, view your email headers
(in Outlook, open message, View-Options) and send a blank email to the
address
listed in the header that starts with 'List-Unsubscribe'.
If you are unable to unsubscribe via the above email address, please email
owner-patchmanagement@xxxxxxxxxxxxxxxxxxx
---
Looking for RSS? The Patchmanagement.org list is available via
http://listserver.patchmanagement.org/read/rss?forum=patchmanagement
PatchManagement.org is hosted by Shavlik Technologies
To unsubscribe send a blank email to leave-patchmanagement@xxxxxxxxxxxxxxxxxxx
If the above unsubscribe doesn't work, view your email headers
(in Outlook, open message, View-Options) and send a blank email to the address
listed in the header that starts with 'List-Unsubscribe'.
If you are unable to unsubscribe via the above email address, please email
owner-patchmanagement@xxxxxxxxxxxxxxxxxxx
---
Looking for RSS? The Patchmanagement.org list is available via
http://listserver.patchmanagement.org/read/rss?forum=patchmanagement
PatchManagement.org is hosted by Shavlik Technologies
To unsubscribe send a blank email to leave-patchmanagement@xxxxxxxxxxxxxxxxxxx
If the above unsubscribe doesn't work, view your email headers
(in Outlook, open message, View-Options) and send a blank email to the address
listed in the header that starts with 'List-Unsubscribe'.
If you are unable to unsubscribe via the above email address, please email
owner-patchmanagement@xxxxxxxxxxxxxxxxxxx
---
Looking for RSS? The Patchmanagement.org list is available via
http://listserver.patchmanagement.org/read/rss?forum=patchmanagement
PatchManagement.org is hosted by Shavlik Technologies
To unsubscribe send a blank email to
leave-patchmanagement@xxxxxxxxxxxxxxxxxxx
If the above unsubscribe doesn't work, view your email headers
(in Outlook, open message, View-Options) and send a blank email to the
address
listed in the header that starts with 'List-Unsubscribe'.
If you are unable to unsubscribe via the above email address, please email
owner-patchmanagement@xxxxxxxxxxxxxxxxxxx
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ | | | |
|
|