SEP 14.3/14.3 MP1 crash at launch

[ICT UNDP]

I've just upgraded from SEP 14.2 RU2 MP1 refresh (14.2.5587.2100) to 14.3 MP1 (14.3.1148.0100) on Windows 10 v1909 Build 18363.959, and yet experiencing the same crashing issue as before with SEP 14.3 (v14.3.558.1000) on Windows 10 v1909 build 18363.778.

It seems some Symantec services stopped on its own and continuously crashes on its own.

Windows Log shows ccSvcHst.exe crashed when calling ucrtbase.dll.

Faulting application name: ccSvcHst.exe, version: 17.2.5.4, time stamp: 0x5ee91bd8
Faulting module name: ucrtbase.dll, version: 10.0.18362.815, time stamp: 0xbea5fce0
Exception code: 0xc0000409
Fault offset: 0x0009e6eb
Faulting process id: 0x2798
Faulting application start time: 0x01d671afe8f42068
Faulting application path: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\14.3.1148.0100.105\Bin\ccSvcHst.exe
Faulting module path: C:\WINDOWS\System32\ucrtbase.dll
Report Id: 1cb01a0c-d42e-41e1-a3b4-26ea44e29954
Faulting package full name:
Faulting package-relative application ID:

And ucrtbase.dll 10.0.18362.815 seems to be fine.

https://www.virustotal.com/gui/file/7ee229626b22799faa28cd7c22d4ff2ad0603c17e5f5ee9086fa7cf6483331fb/details

I've tried to uninstalled with CleanWipe, run "SFC -scannow' and "dism /online /cleanup-image /restorehealth", but still encountered the issue.

Any suggestion would be appreciated.
Many thanks.

[John Owens]

I would suggest gathering a Full Process Dump of when ccsvchst.exe crashes and opening a case for review.  There is a similar issue targeted for a fix in 14.3 RU1.

Steps to get Process Dump:

1. Download Procdump: https://docs.microsoft.com/en-us/sysinternals/downloads/procdump

2. Open a command prompt to procdump location and run the following command.

procdump -ma -i C:\Dumps

3. Reproduce the issue.  Go to C:\Dumps and compress the .dmp files.

4. Run procdump -u

Run a Symdiag on the system as well.

How to collect full support logs for Support with the SymDiag utility

Upload both of these to your case and await review.

[ICT UNDP]

Attached the dump and a Symdiag report.

Attachment(s)

ccSvcHst.exe_200814_123759.zip   92.94 MB 1 version

[John Owens]

Hi There,
You will want to open a case with support to have these reviewed.
Thanks,

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[ICT UNDP]

Thanks @John Owens. Case submitted 32162904.​​

[John Owens]

Can you open a command prompt and run the following command and provide screenshot of results?

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" /v "Public"

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[ICT UNDP]

[John Owens]

Can you try the following as a workaround:

change the registry value REG_SZ to REG_EXPAND_SZ

------------------------------
John Owens
Principal Product Support
Symantec
United States
------------------------------

[ICT UNDP]

It works! Thanks a lot. Now I can launch SEP window without crashing it.

However since all versions of SEP prior 14.3 works fine with REG_SZ, I need to dig back to see if I can find out when Windows 10 changed it to REG_EXPAND_SZ.

[John Owens]

This should be addressed in next 14.3 RU1 release as well. You are very welcome! 

[Sherri Austin]

John,

Is there an estimated release date for next 14.3 RU1 update? I just upgraded our SEPMs to 14.3 MP1 and would like to start upgrading clients. If the next release isnt too far off, I may hold off as we have 50K + clients.

[John Owens]

Eta is Q4. Novemberish.

[John Owens]

Windows Profile Relocator may be changing these if you are using that. 

[hdey_pmcs]

Hi John, what if these settings are already like in the screenshot? Has windows profile relocation something to do with that? I have a customer with Dell Optiplex that has around 30 clients already on 14.3 MP1 with services not starting.. we already uninstalled all non-microsoft applications and did client installations from SES as well with the same result. Fixing the drivers in Windows 10 with dell update did not help either.

------------------------------
PMCS GmbH & Co. KG
------------------------------

[John Owens]

Hi there,

Then it is probably not related to this specific issue. I would open a support ticket with full process dump and symdiag to have reviewed. 

[ICT UNDP]

Symdiag report