This message was deleted.
# citrix-vads
Slackbot
08/13/2020, 4:05 PMThis message was deleted.
👍 1
e
Eirik Vesterhus / Intility AS
08/13/2020, 4:19 PMBeware of this. Prevent this update from entering your environment right now.
r
Ray Davis
08/13/2020, 5:32 PMDoes this apply, if you have AV exclusions?
e
Eirik Vesterhus / Intility AS
08/13/2020, 5:35 PMDon't know. We probably missed some.
n
Neal Dolson
08/13/2020, 5:40 PMNeal Dolson
08/13/2020, 5:41 PMBrokerservice.exe is included in the list for delivery controllers
r
Ray Davis
08/13/2020, 5:41 PMI was cursious if the update totally ignored the exclusion.
n
Neal Dolson
08/13/2020, 5:42 PMWill let you know shortly, that GPO was not linked to one of our OUs in one of our sites and we are remediating
Neal Dolson
08/13/2020, 5:42 PMThe other sites have not updated the definition yet
r
Ray Davis
08/13/2020, 5:43 PMOk, appreciate that Neal
g
Gee
08/13/2020, 5:55 PMJust happened to me as well. Insane
r
Ray Davis
08/13/2020, 5:55 PMexclusion?
Ray Davis
08/13/2020, 5:55 PMor no exclusion?
g
Gee
08/13/2020, 5:57 PMI didn't have an exclusion set
j
James Rankin
08/13/2020, 6:01 PMI am updating my lab now with an exclusion set
James Rankin
08/13/2020, 6:05 PMHigh Availability service would also mean potentially hitting Cloud Connectors also
n
Neal Dolson
08/13/2020, 6:06 PMi restored the .exe through defender, put the proper exclusion gpo in place, rebooted, and the broker service still wont start
g
Gee
08/13/2020, 6:08 PMIm in the same boat Neal
n
Neal Dolson
08/13/2020, 6:12 PMit looks like the "network service" was replaced with "local service"
👍 2
Neal Dolson
08/13/2020, 6:12 PMchanging it back allowed the service to start
j
James Rankin
08/13/2020, 6:14 PMThanks Neal, am tweeting your findings out for people to reference 👍
👍 1
James Rankin
08/13/2020, 6:22 PMWhat OS are you seeing this on? I just applied the patch to Server 2019 DDC, booted back up all OK. However am now running a full scan to make sure
s
Sebastian Parelius
08/13/2020, 6:23 PM2016 here, with 1808.2 VDA.
Sebastian Parelius
08/13/2020, 6:23 PMChecked a controller with 2016 and 2003 VDA, doesn't seem to be affected.
g
Gee
08/13/2020, 6:24 PM2016 on 7.15
j
James Rankin
08/13/2020, 6:24 PMYou mean CVAD version, rather than VDA?
s
Sebastian Parelius
08/13/2020, 6:24 PMYes 🙂
👍 1
n
Neal Dolson
08/13/2020, 6:24 PMWe are running 7.15 on 2016 as well
j
James Rankin
08/13/2020, 6:25 PMI'm on Server 2019 running 2006
James Rankin
08/13/2020, 6:25 PMAnd all seems well so far
e
Eirik Vesterhus / Intility AS
08/13/2020, 6:26 PMSeems it does not affect 2003 and up.
g
Gee
08/13/2020, 6:27 PMNo reports of Citrix Cloud executables being deleted yet.
j
James Rankin
08/13/2020, 6:27 PMWe don't use Defender in Cloud, thankfully 🙂
James Rankin
08/13/2020, 6:39 PMLooks like Citrix are aware
m
Markus Zehnle
08/13/2020, 7:29 PMhttps://support.citrix.com/article/CTX279897
This seems to be the KB but at the moment I have no access... Anyone else?
Found here:
https://discussions.citrix.com/topic/409971-windows-defender-version-418-with-antivirus-definition-132113190-is-detecting-citrix-broker-service-as-trojan-and-deleting-it/
j
James Rankin
08/13/2020, 7:32 PMI've asked them to unrestrict it
👍 2
r
Ray Davis
08/13/2020, 8:44 PMThat was quick
n
Nick Panaccio
08/13/2020, 8:57 PMDidn’t Defender also break FSLogix a few months ago thanks to some update?
n
Neal Dolson
08/13/2020, 8:57 PMYes it did - back in November. It was fuuuun.
r
Ray Davis
08/13/2020, 8:58 PMSo if you have the exclusion in place does it still delete it?
n
Neal Dolson
08/13/2020, 8:59 PMNot in my experience, sample size of 1 site though
r
Ray Davis
08/13/2020, 9:01 PMOk, I am big on AV exclusions. SO if it deleted it, then would it be safe to say its a good idea to check AV exclusions? however, this still may not be the case.
2 Views