Malwarebytes blocking fileshare connections

[JamesThom]

I have an interesting one for discussion.

 

We put MBAM enterprise on a file server on 4/1. Yesterday around 11am we learned no one on an OS older than Vista could connect to shares pre-reboot/Malwarebytes uninstall (this also affected Linux/samba)

 

My sys admins blamed MBAM and removed it during a reboot.

 

The console shows logs show MBAM running fine with nothing being blocked or captured. I can't see how MBAM might have been the root cause.

 

Are there any logs that might reside on the file server that might give me further insight?

 

 

[Lazz]

Hi James.

 

What OS is this file server running?  If it is running any server OS, then unfortunately Malwarebytes is not supported in that environment and may not behave normally.

[JamesThom]

Good to know and thanks for the follow up.

 

It is running 2008 R2. I'll do an audit of our servers now that I know that.

 

Thanks again.

[revbluejeans]

The answer above states "If it is running any server OS, then unfortunately Malwarebytes is not supported "....

But the System Requirements in MBAM for Enterprise states that Windows Server 2008 and 2012 are supported. We have also had the problems described above since installing Malwarebytes.

https://support.malwarebytes.com/customer/portal/articles/1835541-what-are-the-system-requirements-for-the-malwarebytes-management-server-console-and-client-?b_id=6520

[revbluejeans]

3 hours ago, revbluejeans said:

I forgot to also mention that our clients are running Win7 or Win8

 

[djacobson]

In 2014 when this post was started, no server OS was supported by the client software. However that has changed with newer recent releases. Certain Server OS's are now supported by the agent software:

• Windows Server 2012/2012 R2
• Windows Small Business Server 2011
• Windows Server 2008/2008 R2
• Windows Server 2003 (32-bit only)

However, there are some environment roles which are unsupported. Do not install Anti-Malware to a server which runs:

• Terminal Services (TS) / Remote Desktop Services (RDS)
• Virtual Desktop Infrastructure (VDI)
• Windows Storage Server
• Server Core
• Citrix XenDesktop
• Citrix XenApp
• VMware View
• VMware VShield

 

Now as far as the file share connections, it is a known issue that the web blocker real time can interfere with connections to shared drives and applications running from shared drives depending upon the permissions set on those shares. Unfortunately this is not easy to solve as UNC paths are not supported in the ignore list on Anti-Malwares architecture. We instead have two workarounds; disabling the ABE (Access Base Enumeration) settings on the server hosting the share (must be a Windows server, Unix/Linux servers do not have this settings), and the other is creating an AD computer group with the machines having the issue assigned to that group, then giving that group rights over the shares. To troubleshoot your issue more fully, please email our business support team at corporate-support@malwarebytes.com