MBAE Showing Sheilds off on some endpoints

[TeamHorner]

I'm in the process of deploying MBAM and MBAE and have the Malwarebytes Management Console version 1.8.0.3443.  All endpoints are being deployed the same way by removing the Free Endpoint uninstaller, then the system is rebooted, and after it is rebooted the software is deployed.  On several of the endpoints I am getting a gray shield in the Management Console showing that shields are off.  Yet when I go to the endpoint it is showing MBAE is running and when I click on the Shields tab on the endpoing in MBAE it appears that the shields are running as I have the ability to click the Deactivate button.

How can I get these endpoints to have their shields on?

[Rsullinger]

Hello TeamHorner and welcome to the forums!

 

I want to have you collect me some client logs so I can see why it is not sending the status of mbae correctly to the console. To do this:

-Locate the this folder on the client computer: C:\Program Files (x86)\Malwarebytes' Managed Client
-In this folder, right click the 'CollectClientLog.exe' utility and run it as admin.
-Save these logs to the desktop of the computer.
-Zip up this folder and attach it to the next reply.
 

[TeamHorner]

Here are the logs from one of the systems that is showing the shields off.

MBMC_Client_Diagnosis_Info_2017_07_26_182627.zip

[Rsullinger]

Hey TeamHorner,

 

So it looks like this may be due to anti-exploit updating. I want to have you try a couple of things. 

1. On the client, can you try restarting the Meeclientservice and see if it shows the correct version in console?

2. If that does not work, please try rebooting the client and see if that fixes it.

I want to say that 2 will definitely work but I want to confirm to see if my suspicions are correct. 

[TeamHorner]

Going into the services.msc and stopping the MalwareBytes Anti-Exploit service, mbae-svc.exe and then restarting it didn't change the behavior in the Management Console.  After I rebooted the system, the Anti-Exploit Shields are now showing as enabled in the Management Console.  I thought I had done a reboot prior to posting, but with all the systems that I'm deploying to, some may have been missed.

I will try this on the others that are showing the shields off in the management console after hours tonight and report back if that solves it for the balance of the systems.

[Rsullinger]

Hey TeamHorner,

 

I assumed that may be the fix. So anti-exploit is updating which is causing the problem like I mentioned. If it cannot complete the update, it will need to wait until the computer is rebooted to finish the install (completely) and show up correctly in the console. To make sure you are still protected until it happens, we will still run anti-exploit and protect you until you reboot. This normally only occurs if something is preventing our update from happening the moment we try to update. If it cannot, it will do that mentioned process above. 

[TeamHorner]

The reboot of the balance on the systems put the Anti-Exploit into a shields on status.