This message was deleted.
# microsoft-fslogixs
Slackbot
01/31/2023, 9:16 AMThis message was deleted.
k
Kasper Johansen
01/31/2023, 10:18 AMAnything in the FSLogix logs?
g
Geir Sandstad
01/31/2023, 10:19 AMDidn't find anything earlier. When that is said, there's a lot of fixes in the newer versions that might cover this.
k
Kasper Johansen
01/31/2023, 10:19 AMAny 3rd party antivirus agent installed? Have you configured the recommended AV real time scan exclusions
g
Geir Sandstad
01/31/2023, 10:20 AMRunning Defender ATP, all exclusions should be in place. It has worked fine for a while, but they recently migrated more applications over from some older servers. So there's more users logging in now.
Geir Sandstad
01/31/2023, 10:25 AMFound this now in the service log, after I tried to start the service. Seems like it actually starts, but some components fails causing the service to shut down again.
[105802.787][tid:000035dc.00003aec][INFO] ===== End Session: Building user context
[105802.787][tid000035dc.00003aec][ERROR80070008] Service Module 'UserSessions' failed at start (Not enough memory resources are available to process this command.)
[105802.788][tid:000035dc.00003aec][INFO] Service Module 'RuleCompiler' started successfully
[105802.799][tid:000035dc.00003aec][INFO] Service Module 'Network' started successfully
[105802.799][tid:000035dc.00003aec][INFO] Service Module 'ADSComputerMembershipWatcher' started successfully
[105802.800][tid:000035dc.00003aec][INFO] Service Module 'FrxWindowsSearchModule' started successfully
[105802.800][tid:000035dc.00003aec][INFO] Service Module 'UsermodeModule' started successfully
[105802.800][tid000035dc.00003aec][ERROR80070008] Module Start Failed (Not enough memory resources are available to process this command.)
[105802.800][tid:000035dc.00003aec][INFO] Stopping modules
[105802.835][tid:000035dc.00003aec][INFO] Stopping user session notifications
[105802.835][tid:000035dc.00003aec][INFO] Shutting down PrinterRules
[105802.835][tid:000035dc.00003aec][INFO] Shutting down FontRules
[105802.835][tid:000035dc.00003aec][INFO] Shutting down ServiceRuleList
[105802.835][tid:000035dc.00003aec][INFO] Shutting down Computer Object Membership checker
[105802.836][tid:000035dc.00003aec][INFO] Service stopped
[105802.836][tid:000035dc.00003aec][INFO] ===== End Session: ServiceMain
[105802.836][tid:000035dc.00005314][INFO] Registered with SCM
[105802.836][tid:000035dc.00005314][INFO] Exit main
[105802.836][tid:000035dc.00005314][INFO] ===== End Session: FSLogix Service
k
Kasper Johansen
01/31/2023, 10:34 AMI haven't seen this before. Could you try removing the current FSLogix configuration in registry and then start the service again?
👀 1
g
Geir Sandstad
01/31/2023, 10:35 AMMy guess... another FSlogix bug, resource exhaustion or something
Geir Sandstad
01/31/2023, 10:39 AMDeleting the configuration did not make a difference, either.
k
Kasper Johansen
01/31/2023, 10:39 AMHmm...
Kasper Johansen
01/31/2023, 10:39 AMProbably a bug then
g
Geir Sandstad
01/31/2023, 10:41 AMI've managed to restart the service on all but two of the affected servers. Those two servers have been set to maintenance mode until later. We're running MCS, so there's a new snapshot being deployed later this week, so I have updated Fslogix there. The servers will reboot this weekend, so I guess we'll just have to wait and see if the problem comes back next week.
👍 1
s
Sebastian Parelius
01/31/2023, 11:32 AMHave you excluded the lsass process from AV? Saw something similar - not exactly the same, but still
g
Geir Sandstad
01/31/2023, 11:33 AMNope, don't think so unless it's part of the recommended processes for exclusion.
Geir Sandstad
01/31/2023, 11:37 AMLooks like lsass is excluded by default on Win2019? https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-s[…]exclusions-microsoft-defender-antivirus?view=o365-worldwide.
"Default exclusions for all roles
This section lists the default exclusions for all roles in Windows Server 2016, Windows Server 2019, and Windows Server 2022."
Geir Sandstad
01/31/2023, 11:37 AMLsass is mentioned further down.
s
Sebastian Parelius
01/31/2023, 12:00 PMSeems to only be automatically excluded if you have AD DS role installed: This section lists the exclusions that are delivered automatically when you install Active Directory Domain Services (AD DS).
🙌 1
g
Geir Sandstad
01/31/2023, 12:03 PMOk, thanks. I didn't read through everything. TL;DR. 😛
Anyway, things are mostly working atm, so we've decided to just see what the upgrade does for us after the weekend. I've added a recovery setting for the service via GPO, so hopefully most of the users won't be affected much. There aren't really that many using the service, and most of them uses a web browser to access internal resources.
s
Scott Knights
01/31/2023, 11:16 PMI was testing something yesterday on a server I had taken out of production. I stopped the service, but got this message when trying to restart. No load on the server and plenty of memory free. Service started after rebooting. Latest FSlogix build.
g
Geir Sandstad
02/01/2023, 8:20 AMLovely, Scott... well, so far enabling service recovery on the current version seems to have stabilized things for the short term. I guess I'll just have to wait and see if the latest version is just as bad.
j
Jesper Graff
02/09/2023, 9:28 AMTry and disable the installation of AppX packages
It solved it for us
g
Geir Sandstad
02/09/2023, 9:28 AMHm... worth a try....
3 Views