Q: McAfee VSE cause Windows Update failure. Or windows update process slower than usual on McAfee VSE or ENS Installed systems. How to fine tune McAfee and fix Windows Update failure?
Cause of Issue
Windows regularly check for updates and Install them if any available. Windows update services does read and write many files to perform update operation. McAfee VSE or ENS OnAccess Scanner (OAS) scans each and every I/O request due to which OS update operation become slow. Often it gets failed with timed out error.
The term “McAfee VSE cause Windows Update failure” is not correct. Actually McAfee OAS doing it work as expected. Rather I would say McAfee needs fine tuning. Lets see how. Treat Windows Update related files as trusted ones. So add them to OnAccess Scanner (OAS) exclusion. No worries, these files are still scanned by OnDemand Scanner (ODS). Hence security of the system is still preserved.
There are standard files should be considered for exclusion. Have provided such list with details below. In some cases excluding these standard files from OAS alone will not help. Need to analyze the system behavior and might need to exclude more files. Refer Review McAfee OAS behavior section to find those details.
Note: In any situation carefully review the exclusions before adding them. Because exclusions should be derived based on your security need and IT environment. Improper exclusions could potentially weaken your systems security strength.
McAfee OAS Files Exclusion
Windows Update or Automatic Update related files
?:\Windows\SoftwareDistribution\Datastore\Datastore.edb ?:\Windows\SoftwareDistribution\Datastore\Logs\Edb*.jrs ?:\Windows\SoftwareDistribution\Datastore\Logs\Edb.chk ?:\Windows\SoftwareDistribution\Datastore\Logs\Tmp.edb
Windows Security files
?:\Windows\Security\Database\*.edb ?:\Windows\Security\Database\*.sdb ?:\Windows\Security\Database\*.log ?:\Windows\Security\Database\*.chk ?:\Windows\Security\Database\*.jrs ?:\Windows\Security\Database\*.xml ?:\Windows\Security\Database\*.csv ?:\Windows\Security\Database\*.cmtx
Group Policy-related files
?:\ProgramData\NTUser.pol ?:\Windows\System32\GroupPolicy\Machine\Registry.pol ?:\Windows\System32\GroupPolicy\Machine\Registry.tmp ?:\Windows\System32\GroupPolicy\User\Registry.pol ?:\Windows\System32\GroupPolicy\User\Registry.tmp
McAfee OAS Process Exclusion
Setup a low-risk policy with no scanning on both read & write. Then add these two processes to that low-risk policy.
Review McAfee OAS behavior
Once above exclusions are applied to system, start testing it. Use the McAfee profiler tool to review the McAfee OAS behavior against system I/O request.
Refer this McAfee KB article to get the details and McAfee Profiler Tool – KB69683. Valid McAfee grant number needed to download the Profiler tool.
- Start the McAfee Profiler Tool with 10mins duration and let it run
- Start the Windows Updater and let it Install updates
- Once the Profiler finished, review the output. See if there are any other files with high I/O count. If No, then windows update should be finished as expected.
- Otherwise, review the high I/O count registered files carefully and add them to exclusion as well.
Did you come across similar Issue? Was the solution provided helped to fix it? Please write your suggestions and questions in comments sections. Thank You !!
2 thoughts on “McAfee VSE cause Windows Update failure”
Issue: The Windows 10 Anniversary Update is not compatible with VSE 8.8 Patch 7 and earlier. Microsoft did not have in place upgrade prevention protection when VSE 8.8 Patch 7 or prior was installed. Workaround: Delay upgrading to the Windows 10 Anniversary Update or ensure that VSE 8.8 Patch 8 is installed before you upgrade Windows 10 to the Windows 10 Anniversary Update. See the related article for additional details. Issue: Systems with multiple McAfee products that use SysCore installed (such as VSE 8.8 Patch 7 and McAfee Agent 5.x or Host Intrusion Prevention 8.x) hang at startup. Workaround: Disable Prefetch startup options. See the related article.
Both VSE patch 7 and 8 are older versions. No one uses it now AFIK.