SCEP crashing on machines with NAV 2016

afarr

On machines with NAV 2016 and Windows 8.1 or Windows 2012 R2, we are finding that System Center Endpoint Protection (SCEP – an antivirus produced by Microsoft) keeps crashing.

The error from Event Viewer is below. The faulting module MSVCR120.dll is for MS Visual C Redistributable.

Faulting application name: MsMpEng.exe, version: 4.10.207.0, time stamp: 0x58070b2f
Faulting module name: MSVCR120.dll, version: 12.0.21005.1, time stamp: 0x524f83ff
Exception code: 0xc0000409
Fault offset: 0x000000000006dd27
Faulting process id: 0x4780
Faulting application start time: 0x01d24ad79b2d384e
Faulting application path: c:\Program Files\Microsoft Security Client\MsMpEng.exe
Faulting module path: C:\windows\SYSTEM32\MSVCR120.dll
Faulting package full name:
Faulting package-relative application ID:

I had solved this once by removing NAV 2016, removing Visual Studio and anything else that uses VC++, removing SCEP, restarting, and then re-installing those products.

Over the months, we installed some other builds of NAV 2016. The error is now re-occurring.
We have a similar Windows 2012 R2 machine with NAV 2015 and NAV 2017, and SCEP runs fine there.

Has anyone encountered this before?

Thanks,
Alastair

afarr

Microsoft told me that the problem is caused by a particular dll, and this was fixed in NAV 2016 CU8 (build 46045).
https://mbs2.microsoft.com/Knowledgebase/KBDisplay.aspx?scid=kb;EN-US;3166287

So there are two ways to fix this problem (even with this fix, Endpoint Protection seems to take a few minutes to start a full scan, but it did finish it without problem):

a) uninstall NAV 2016, and install build 46045 (or later)

or

b) replace Navsip.dll with the dll from NAV 2016 build 46045 (or later), as shown below.
To be safe, rename the existing dll, just in case you want to go back to it.

C:\Windows\System32\Navsip.dll - rename, and install
<DVD for CU8>\RoleTailoredClient\SystemFolder\Navsip.dll

C:\Windows\SysWOW64\Navsip.dll - rename, and install
<DVD for CU8>\ServiceTier\System64Folder\NavSip.dll

vremeni4

hi

NAV uses the newest version of "Microsft Visual C++ redistributable".
If SCEP uses an older one, when you install NAV or any other program that use "Microsft Visual C++ redistributable" then it will overwrite the old version used by SCEP.
SCEP will look for old version it cannot find it , hence errors.
If you install NAV first then the new version of "Microsft Visual C++ redistributable" will be installed. If you install SCEp after that then it will recognise that "Microsft Visual C++ redistributable" is a new version or not, I am not sure.

Anyhow I think this is more a question for SCEP community, as it seems that their libraries do not play very well with NAV and newest versions of Windows.
For that reason, I think SCEP community would be the right place to ask.
Also other antivirus software might be an option.

I hope this helps.

afarr

Hi vremeni4.

Many thanks for your post. I did not get notified about it, which is why I'm only replying now.

My (temporary) solution was to uninstall NAV 2016, SCEP and other products, and then re-install SCEP, followed by NAV 2016. So I don't think that NAV always overwrites the "Microsft Visual C++ redistributable" (or if it does, then it doesn't always cause this problem).

I will check with the SCEP community.

afarr

I opened a MS support case, and was told that it's a known issue. They suggested a workaround (which still leaves the machine vulnerable in some places, which is why I'm not giving the details here).

Regards
Alastair

afarr

Microsoft told me that the problem is caused by a particular dll, and this was fixed in NAV 2016 CU8 (build 46045).
https://mbs2.microsoft.com/Knowledgebase/KBDisplay.aspx?scid=kb;EN-US;3166287

So there are two ways to fix this problem (even with this fix, Endpoint Protection seems to take a few minutes to start a full scan, but it did finish it without problem):

a) uninstall NAV 2016, and install build 46045 (or later)

or

b) replace Navsip.dll with the dll from NAV 2016 build 46045 (or later), as shown below.
To be safe, rename the existing dll, just in case you want to go back to it.

C:\Windows\System32\Navsip.dll - rename, and install
<DVD for CU8>\RoleTailoredClient\SystemFolder\Navsip.dll

C:\Windows\SysWOW64\Navsip.dll - rename, and install
<DVD for CU8>\ServiceTier\System64Folder\NavSip.dll