Windows Server 2022 Update Issue Error STATUS_ACCESS_DENIED?

[Maxstar]

HI,

In a thread at Sysnative I've discovered the following issue with Nebula Agent / Client?

https://www.sysnative.com/forums/threads/rds-windows-server-2022-cu-updates-will-not-install-error-0x8007007e.41070/

2024-07-20 11:53:44, Info                  CSI    000006e0@2024/7/20:17:53:44.734 CSIPERF - FileMapsCreated 212ms
2024-07-20 11:53:44, Info                  CSI    000006e1 CSIPERF - FilePI Commit 296ms
2024-07-20 11:53:44, Info                  CSI    000006e2 SMI Primitive Installer [done]

2024-07-20 11:53:44, Info                  CSI    000006e3@2024/7/20:17:53:44.859 Primitive installers committed
2024-07-20 11:53:45, Info                  CSI    000006e4 ICSITransaction::Commit calling IStorePendingTransaction::Apply - applyflags=13
2024-07-20 11:53:45, Info                  CSI    000006e5 Creating NT transaction (seq 1)
2024-07-20 11:53:45, Info                  CSI    000006e6 Created NT transaction (seq 1) result 0x00000000, handle @0x1104
2024-07-20 11:53:45, Info                  CSI    000006e7 Transaction UoW: {e77214f0-46c0-11ef-bafb-00155d0a2206} for BeginTransaction
2024-07-20 11:53:45, Info                  CSI    000006e8   0: RM locking process: [l:15 ml:16]'MBEndpointAgent', app type: 3, app name: 'Malwarebytes Endpoint Agent', svc name: 'MBEndpointAgent', restartable: true
2024-07-20 11:53:45, Error                 CSI    000006e9@2024/7/20:17:53:45.359 (F) onecore\base\wcp\telemetry\default\wcptracelogging.cpp(56): Error STATUS_ACCESS_DENIED originated in function OpenProcessSafe expression: NtOpenProcess( &Handle, (0x0400), &ObjAttributes, &ClientId)
[gle=0x80004005]

After removing the Nebula Agent / Client the OP was able to install the latest cumulative update. It seems it only happens on Server 2022 RDS systems?

Are there any particular log files to investigate this problem on such servers?

[Porthos]

I would highly suggest that you contact Business Support to work with them directly.

https://support.threatdown.com/hc/en-us/p/nebula_support

[Maxstar]

I understand, but it's not my server. I only helped someone with this problem on Sysnative see the link in the first post.

That's the reason why I started a thread here first, but I've posted your link at Sysnative for the OP if the issue still persists with the next cumulative update.

[Porthos]

6 minutes ago, Maxstar said:

I understand, but it's not my server. I only helped someone with this problem on Sysnative see the link in the first post.

That's the reason why I started a thread here first, but I've posted your link at Sysnative for the OP if the issue still persists with the next cumulative update.

This part of the forums are not visited very often by anyone who can help hence the advice to always contact support with the issues with the business offerings of Malwarebytes known as Threat Down now.

Edited August 29 by Porthos

[AdvancedSetup]

Thank you @Maxstar

I will forward the information along to our Business Support Team

 

[Maxstar]

Thank you very much @AdvancedSetup if I'll need to provide the complete CBS logs from the thread at Sysnative, please let me know.

[AdvancedSetup]

Thank you again. As soon as I hear something I'll let you know. @Maxstar

Appreciate the heads up

 

[Tyzzara]

Any updates on this specific issue? 

[AdvancedSetup]

I have not heard anything back.

Please send me a Private Message with your full name and email address and I'll submit to create a support ticket for you.

Thank you @Tyzzara

 

[AdvancedSetup]

Request to create a business support ticket directly was determined to be the best option. I will go ahead and close this topic now.

 

Business Support

Nebula
https://support.threatdown.com/hc/en-us/p/nebula_support

Oneview
https://support.threatdown.com/hc/en-us/p/oneview_support