36 posts in this topic

Hi, suddenly some client stop communicating with management console. client is online but it's showing offline on management console. please help. already uninstall and install client.

 

thanks,

 

preyash parekh 

Share this post


Link to post
Share on other sites

Hello Preyash,

I want to have you check the managed client service to make sure it is running. The managed client is what facilitates the connection between the clients (anti-malware and anti-exploit) and the server. If you go into the services menu, it will be called 'meeclientservcie'. If it is not running, try starting the service and see if it starts. If that does not communicate, then I would want to see the client logs so I can see why it is not connecting. 

-Locate the this folder on the client computer: C:\Program Files (x86)\Malwarebytes' Managed Client
-In this folder, right click the 'CollectClientLog.exe' utility and run it as admin.
-Save these logs to the desktop of the computer.
-Zip up this folder and attach it to the next reply.
 

Thank you,

 

Ron 

 

Share this post


Link to post
Share on other sites

Thanks Ron,

 

i start service on my machine and i will have look tomorrow morning. is that any reason this service is not start automatically.

Share this post


Link to post
Share on other sites

Hi Ron,

 

can you please let me know why 'meeclientservcie' stop automatically. its work for few days and after that stop again. I setup that services on automatic startup.

 

please advice.

 

thanks,

 

Preyash Parekh

Share this post


Link to post
Share on other sites

Hello Preyash,

 

We would need to get logs to know for sure. It could be due to windows updates or interacting with the service (like an AV). Can you get those logs so I can see if anything in the log shows why it stopped? 

Share this post


Link to post
Share on other sites

Hi Ron,

 

i will check tomorrow again because today i started service for all users again. If happen tomorrow i will send you log from that PC.

thanks,

 

preyash

 

Share this post


Link to post
Share on other sites

Hey Preyash,

 

In the last entry it shows the client was simply just trying to send a client update status to the server and it stopped. It didn't go through the normal stop procedure. One thing I noticed in the log that was odd was these two time stamps:

 

2016-10-20 16:42:52.865: Launch mbae api, filename: C:\Program Files\Malwarebytes Anti-Exploit\mbae-cli.exe, parm: /shield helpctr
2016-10-24 08:21:11.298: mbae-cli.exe exit code: 0, parm: /shield helpctr

 

It took 4 days to launch that command and give the error code back. The service never stopped in between those 4 days, it just did nothing. This is something similar I saw in an older version of the managed client. In the logs, I see the managed client is on version 1.5 which is a couple of versions out of date. Do you have the latest version of the management console? You can find this out by signing in and looking at the bottom left corner. The current most up to date version is 1.7.0.3208. If you do have that version of the console, then I want to have you deploy the client over the top on this computer and see if the issue still occurs. 

 

If you are not on the latest version, then you can use the instructions here to upgrade the server so you can deploy the new client version:

 

https://support.malwarebytes.com/customer/portal/articles/1835539?b_id=6401

Share this post


Link to post
Share on other sites

ho ron,

 

i am getting below error when try to update console. i login as administrator on server.

 

Share this post


Link to post
Share on other sites

Hello Preyash,

 

What was the error message? I am not seeing the message in the last response. Is it saying that you must log into the administrator account or the account originally used to install the product? 

Share this post


Link to post
Share on other sites

yes,

 

i also login as administrator. this is the same account when i install this MBMC.

Share this post


Link to post
Share on other sites

Hello Preyash,

 

I am going to send you a PM with a file that will help this issue. The sql account may have been swapped to another use and I am giving you a .bat file to help. 

Share this post


Link to post
Share on other sites

Hi,

already upgrade server and client on machine but still service is get stop. I have to start manually. 

Share this post


Link to post
Share on other sites

HI,

 

when I try to collect the log I am getting different error. see the attachment.

MBMC ERROR.JPG

Share this post


Link to post
Share on other sites

Hello Preyash,

 

Can you try running that tool as administrator and see if you get the same message? I want to see the logs for the other issue, but I think running that as admin should fix the issue with collecting the logs. 

Share this post


Link to post
Share on other sites

Hello Preyash,

 

It seems like the service stopped after this event:

Info    2016-11-11 14:01:58.1803    1764    7    Sent client status successfully.

After that, it does not communicate. Can you grab the event viewer logs from that time and see if there is any errors with the services? Also, would you have possibly had any updates or policies being pushed out that may have occurred at that time? We may need to collect further diagnostic logs from the computer. These logs do have information about the computer that you may not want on the forums (signed in users) so if you want, please send them to me via PM.

1: Please download FRST from the link below and save it to your desktop:

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

2: Double-click the purple FRST icon to run the program. Click Yes when the disclaimer appears.

3: Click the Scan button

4: When the scan has finished, it will make 2 log files in the same directory the tool is run, FRST.txt and Addition.txt. Please attach both files in your reply.
 

 

Share this post


Link to post
Share on other sites

hi,

 

i found that after any windows 10 update service wasn't start automatically. can you please find out why service not start? also please find the attached log file.

 

thanks,

 

Preyash parekh

Addition.txt

FRST.txt

Share this post


Link to post
Share on other sites

Hello Preyash,

 

Thank you for those. Do you mind grabbing me the event viewer logs as well? If it is due to windows update, that should have a bit more information on it. While FRST does show some event viewer information, it doesn't show all of it and I want to see all the events that occurred on that startup. This will give a bit of information to do this:

 

https://technet.microsoft.com/en-us/library/cc749339(v=ws.11).aspx

 

I will want to see the system, application, and security logs. Go ahead and send those to me in a PM if you do not want them posted publicly. 

Share this post


Link to post
Share on other sites

Hi,

 

sorry for the delay. please find the attached log. ( we are close for the Christmas from 23rd to 4th of January.  i can access my PC after that).

Event log.zip

Share this post


Link to post
Share on other sites

Hi for more information.

there was windows update on another PC on 14th December after that services didn't start. please find the attach information regarding windows update

 

Windows update.docx

Share this post


Link to post
Share on other sites

Hello Preyash,

 

Unfortunately the system logs didn't give me the information I was hoping to see. I do see the update being applied but not seeing our service failing to start during the timeframe it was being applied. I even saw anti-malware update its services and start them just fine but nothing on the management service. Is this the only windows 10 computer you have that is having the issue or the only one you have noticed it on (since it was yours). 

Share this post


Link to post
Share on other sites

hi,

 

sorry for the late response.
yes we have all windows 10 computer. there was another windows update install on 11 th Jan and few system has services stop. from 11 January. can you please find the solution for me.

 

thanks,

 

Preyash Parekh

 

Share this post


Link to post
Share on other sites

Hello Preyash,

 

We are currently looking into this and why this is occurring. If you have one currently doing this, can you try: "Set the failure options for the sccomm service(MeeClientService) under Properties-> Recovery to 'Restart the Service' for all 3 fail options".

 

After you do that, can you reboot the computer and see if it connects to the server? 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.