Jump to content
Alex_Taylor

Offline clients showing as online in console

Recommended Posts

Hi

I've got a number of clients here that continue to show as online in the management console, after having been powered off. If I manually stop the MEEClientService, they show as offline almost immediately, and show as online when I restart the service. From the logs, it looks like the service isn't even trying to notify the server of the shutdown. This is client version 1.8.0.3443. Logs from an example machine attached.

Many thanks in advance for any help that anyone can give me!

MBMC_Client_Diagnosis_Info_2017_10_31_161712.zip

Share this post


Link to post
Share on other sites

Thanks for the reply.

It's currently set to 1 minute. It was on the 'auto' setting -  I changed it yesterday while reading another forum post from someone with the same problem, to see if I could fix it before posting here. Changing the setting didn't seem to make any difference.

Share this post


Link to post
Share on other sites
On ‎31‎/‎10‎/‎2017 at 11:58 PM, djacobson said:

How long is your check-in timer set for? Policy > your policy > Edit > Communication.

Hi

Any further info about this? It's been a week since your reply.

Thanks

Share this post


Link to post
Share on other sites

Hi Alex, 

Sorry for the late response. 

According to logs provided, it appears sending the offline command. 

Could you please provide me some more details how these endpoints are powered off?

 

Thanks in advance, 

Share this post


Link to post
Share on other sites

Hi

Thanks for your reply.

Your question made me think, and I think I've found the answer myself. Some quick testing shows that it's caused by Windows 10's hybrid shutdown/fast startup. If I turn that off with powercfg /hibernate off, then shut down (which is being done the normal way, via the start menu), then the log file shows the client shutdown.

I need to do some more testing, but you can probably consider this issue as resolved.

Share this post


Link to post
Share on other sites

Hi Alex, 

Thank you for the update and for the good news.
I am happy to hear you are Ok at the moment.

Share this post


Link to post
Share on other sites

Hi @Alex_Taylor, I apologize, I didn't mean to leave you hanging :( my particular location was having a team training week leaving me unable to reply. That's a great find regarding the fast user switching and hibernation. We have seen that some newer machines can turn off faster than client communicator can send a status that it is offline. This also revolves around your check-in interval, if the machine turns off in between its cycle, more so if it is a long cycle, it may not be able to update the console in time. Let me bring your find to QA for testing as well, when confirmed we will create a KB article around this. Thanks Alex!

Share this post


Link to post
Share on other sites

My boss is asking me what might have changed, because we weren't having this problem before. Something must have changed in Windows or in Malwarebytes. Would you have any idea which one it is?

Thanks!

Share this post


Link to post
Share on other sites

Hey Alex, there's been no changes to your version of Malwarebytes. MBAM 1.80.2.1012 was released Sept 21st 2015, and MBMC 1.8.0.3443 has been out since March 22nd 2017. As far as changes to Windows, I'm not really able to speak on that, though one could deduce it's likely some change that came down with updates, though I do not know which one it could be or when it happened.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.