Locking up at "applying user settings" on servers?

[mfitak]

I have malwarebytes endpoint security, pushing antimalware for business and antiexploit for business. Around 10 hours after pushing the install to all computers, a server 2008 R2 standard stopped responding to remote access and required a hard shutdown. When starting back up it locks up at applying user profiles. We tried 3 different user accounts, and it never completed startup, all required a hard shutdown. I started the server in safemode, disabled malwarebytes, and it started correctly. I then removed malwarebytes. That evening (26 hours after install), our server 2012 R2 stopped responding. We again had to shut it down hard, so this time I did no further diagnosis and uninstalled malwarebytes. It started up just fine, so I removed malwarebytes from our other 2 servers to be safe. In over a week, we have had not further server issues. No workstations had problems.

 

Any ideas?

[StroTech]

We had a similar issue, but with workstations. Most the time they would not get past the log in screen without freezing. Had to set Malwarebytes to delayed start in Malwarebytes settings: Under the Policy editor, protection tab, statup delay.

They told us the issue was likely due to our Trend Micro conflicting with it. But it still does it even when trend micro is off and the delayed start is not set.

[StroTech]

Actually found that whitelisting these In Trend Micro might have done the trick, no longer have to delay start Malwarebytes:

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\SYSTEM32\ntdll.dll                                    
C:\WINDOWS\System32\wow64.dll                                    
C:\WINDOWS\System32\wow64win.dll                                 
C:\WINDOWS\System32\wow64cpu.dll
 

Again this was for workstations, not sure if it will work on servers, but worth a try. Will of course need to whitelist them in whichever other AV product you might be using.

Edited July 6, 2017 by StroTech

[djacobson]

@mfitak, if StroTech's feedback did not help, feel free to gather diag info with this tool.

Frst Log
Please follow the steps below to run frst.

1.) Please download frst and frst64 from the link below and save it to your desktop:

FRST 32-bit version: https://downloads.malwarebytes.com/file/FRST
FRST 64-bit version: https://downloads.malwarebytes.com/file/FRST64

Note: You need to download the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your computer; that will be the right version. Some traditional Anti-Viruses may false positive the download or running frst, I can assure you it is safe. If this happens, please temporarily disable the AV.

2.) Double-click the purple frst or frst64 icon to run the program. Click Yes when the disclaimer appears.
3.) Click the Scan button
4.) When the scan has finished, it will make 2 log files in the same directory the tool is located, frst.txt and Addition.txt.

Please attach frst.txt and Addition.txt in your reply.

 

[djacobson]

locking due to inactivity