Tamper Protection Causing Windows Update Error

[zgerber08]

Hello. I read about the June 1 release of the Tamper Protection feature for services and processes, which was automatically enabled on all policies. I didn't mind having it enabled, as it seems like an incredibly useful feature. While trying to install an Exchange cumulative update .iso yesterday afternoon, we began seeing error messages (included below without identifying information) as the update was unable to stop the Malwarebytes service. We were able to manually Ctrl right click the tray icon to stop the service, and the update was then able to proceed normally. Will this be normal behavior going forward or will Malwarebytes be adding exclusions to the tamper rules for Microsoft-signed updates? Needing to use Ctrl right click isn't a noticeable inconvenience, but I thought I should ask anyway.

 

Error:

The following error was generated when "$error.Clear();

          & $RoleBinPath\ServiceControl.ps1 -Operation:DisableServices -Roles:($RoleRoles.Replace('Role','').Split(',')) -SetupScriptsDirectory:$RoleBinPath;

          & $RoleBinPath\ServiceControl.ps1 -Operation:Stop -Roles:($RoleRoles.Replace('Role','').Split(',')) -IsDatacenter:([bool]$RoleIsDatacenter)

        " was run: "Microsoft.Exchange.Configuration.Tasks.ServiceStopFailureException: Service 'MBAMService' failed to stop due to error:'Cannot stop MBAMService service on computer '.'.'. ---> System.InvalidOperationException: Cannot stop MBAMService service on computer '.'. ---> System.ComponentModel.Win32Exception: Access is denied

   --- End of inner exception stack trace ---

   at System.ServiceProcess.ServiceController.Stop()

   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StopService(ServiceController serviceController, Boolean ignoreServiceStopTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime)

   --- End of inner exception stack trace ---

   at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception exception, ErrorCategory errorCategory, Object target, String helpUrl)

   at Microsoft.Exchange.Configuration.Tasks.Task.WriteError(Exception exception, ErrorCategory category, Object target)

   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StopService(ServiceController serviceController, Boolean ignoreServiceStopTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime)

   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StopService(ServiceController serviceController, Boolean ignoreServiceStopTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime)

   at Microsoft.Exchange.Management.Tasks.ManageSetupService.StopService(String serviceName, Boolean ignoreServiceStopTimeout, Boolean failIfServiceNotInstalled, Unlimited`1 maximumWaitTime)

   at Microsoft.Exchange.Management.Tasks.StopSetupService.InternalProcessRecord()

   at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__91_1()

   at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)".

[AdvancedSetup]

Hello @zgerber08

It would be best if you created a Business Support Ticket to have direct access to the support team.

Thank you