Another CiscoAMP rollout - Same issues

dwalker1 — Thu, 19 Aug 2021 15:21:02 GMT

Hello,

Last week I rolled out version 7.4.3.20630 from 7.4.1.20439. After the update, it could be few hours, a day or week later, users start experiencing freezing, slowness, system hangs. Right away I knew what was causing it. Windows Security Center doesn't show CiscoAMP(the service is running), sometimes Windows Defender would turn on because Windows doesn't detect any antivirus so it's running along side CIscoAMP and the Cryptographic Service will be constantly using disk usage 10 MB/s + non stop. It's very difficult to do anything when this happens because as soon as the system boots up, the slowness and freezing starts. I would need to repeatedly end task/restart the cryptographic service for anything to load. I would uninstall CiscoAMP, rename the caroot2 folder, install CIscoAMP then reboot solve the problem. CiscoAMP would be displayed in WSC afterwards and system is back to normal.

Security apps installed:

SEP(Firewall only)

CiscoAMP

Umbrella Roaming Client

Has anyone else been running to these same issues?

Thanks

Re: Another CiscoAMP rollout - Same issues

Ken Stieers — Thu, 19 Aug 2021 15:42:11 GMT

I rolled 7.4.x to my test group, and haven't heard any issues yet.
What exclusions do you have in place in your policy? We only have Windows Default and Workstation Exclusions for FireAMP... (which includes the Cattroot2 folder...)

Re: Another CiscoAMP rollout - Same issues

dwalker1 — Thu, 19 Aug 2021 16:37:46 GMT

Hi Ken,

No exclusions set. Everything is at the default settings. I'll add the Catroot2 to the list and see if that helps down the road.

Thanks

topic Re: Another CiscoAMP rollout - Same issues in Endpoint Security

Another CiscoAMP rollout - Same issues

Re: Another CiscoAMP rollout - Same issues

Re: Another CiscoAMP rollout - Same issues