Shield off for some users in MMC

[Arsh]

Hi Guys,

I am testing MMC for awhile now and I really like it but at times, on few of the users, the Anti-exploit Shield turns off automatically. I don't know what triggers it or how to solve it. 
I went over to the machine/client and saw that the shield was off and saw that the anti-exploit service was off whereas anti-malware was running just fine and had no issues what so ever. 

Please see the photo to see what I'm talking about (in the photo I'm hovering the mouse on top of the first client hence the grey shield, not red).

Any update from you guys about this issue would be really appreciated.

[Rsullinger]

Hello Arsh,

 

This can sometimes happen when mbae is updated which a reboot should be able to fix quickly. But I also want to have you collect me the logs so I can be certain of the issue. To do this:

-Locate the this folder on the client computer: C:\Program Files (x86)\Malwarebytes' Managed Client
-In this folder, right click the 'CollectClientLog.exe' utility and run it as admin.
-Save these logs to the desktop of the computer.
-Zip up this folder and attach it to the thread. 

[Arsh]

Thank you for your reply Rsullinger,

Even after the reboot of the clients and the console itself, the shield is off.

And when I go to  C:\Program Files (x86) , I don't see Malwarebytes' Managed Client, I only see Malwarebytes Managed Console and Server.

Please check the attached photo.

 

[Rsullinger]

Hello Arsh,

 

The log collection would have to be done on the client having the issue. So if you are checking the server, unless it is the one having the issue you will have to check on the other machine. Thank you for the confirmation of the reboot however, I think I know the issue but the logs will confirm it. 

[Arsh]

Thank you for your reply.

Unfortunately my college isn’t here today so I’m afraid I won’t be able to get you the log files today as he takes his surface pro home with him.

Perhaps I'll get you the log files on Monday

[Rsullinger]

Hello Arsh,

 

No problem. Let me know when you are able to get those!

[Arsh]

Hey Ron,

Following are the log files of the surface pro on which the shield is off. 

 

MBMC_Client_Diagnosis_Info_2016_12_05_084959 Ma.zip

[Rsullinger]

Hello Arsh,

 

Yea it seems to be due to the upgrade to 1.09. Can you try installing this build over the top on the client and see if it starts after that:

https://malwarebytes.box.com/s/5ej3sggeli8ut9hhktz51wkkzvdtbscl

 

 

[Arsh]

Sorry, but just to double check, you want me to install that on the client on which the shield is off or on the console?

[nguyeal]

Hi,

I had similar issue with some machines installed both Anti-Malware and Anti-Exploit. The Anti-Exploit engine is running on the client however the Management Console shows that the shield is off.

What I did to fix is to switch the machine to a different Policy, then the shield shown as on. Then switch the machine back to the original policy and the shield stays on.

Also there certain policies that when using Push install, it show the shield as off, however when push install to a client using the default policy then the shield is on.

Hope it helps