Does MBARW change Windows Remote Desktop settings?

[JohnFromVT]

I have a fleet of Windows 7 Professional PCs, all are protected with Malwarebytes Anti-Exploit for Business 1.05.2.1017, Malwarebytes Anti-Malware Enterprise 1.75.0.1300, and Malwarebytes Anti-Ransomware 0.9.18.807. They are also running ESET Endpoint Security 6.6.2052.

I've had two instances where certain PCs become somewhat unresponsive... meaning the mouse works, but most if not all apps lock up. Sometimes the user can wait it out (15+ minutes) and things come back. Bringing up the Task Manager to view processes running by all users is impossible, but one time I did see (using Spiceworks troubleshooting tool) the MB3Service.exe (only used by MBARW since other MB products are earlier versions) using 100% CPU. I've read on these forums other people seeing similar lockups and it seems to point back to MBARW.

My question for the time being, is that on these two computers, I have to crash them. When they come back up, I cannot remote into them because Windows Remote Desktop settings have changed from allowing connections to not allowing connections. This is not a setting enforced by Group Policy or anything otherwise. I can change it back and all is well. Just trying to get an idea on what the culprit might be.

[djacobson]

I'm not aware of MBARW having the ability to change RDP. A thing to note is your deployment looks to be very behind, we are on; MBAM 1.80.2.1012, MBAE 1.10.2.41 and MBARW 0.9.18.806-1.1.100. Your 0.9.18.807 MBARW is the consumer beta build and not the business build as well. Make sure you are using the installers from this package - https://downloads.malwarebytes.org/file/mbes_for_business - they are located in Unmanaged \ Windows.

[JohnFromVT]

Hi Dyllon, thanks for the reply. I'll get the workstations updated with the right MBARW version... I do have some that are on the business build but not all, and not the ones that are experiencing problems. As for updating the other products, I'll note that they should also be updated. Thanks again.