KES11 - Windows server backup failure "failed to lock EFI partition"

[dmack]

Recently we have had five servers (across multiple sites, all Windows Server 2012 Standard or R2 Standard) all start to fail their Windows server backups with an error of "Failed to get an exclusive lock on the EFI system partition."

 

Stopping Kaspersky via the Security Center resolves the issue and backups work as normal, but once it is started again the backups will fail. I ran KAVRemover on each server, rebooted, and re-installed the latest KES version (11.0.1.90) which seemed to fix it for a few days but they are all now failing again with the same error as before with no other changes being made.

 

• My GSI Report from one of the affected servers: https://www.getsysteminfo.com/report/a31317050fc0719d12413c20320d14d4
• Let me know if more "complete event logs" are needed beyond what GetSystemInfo gathers.
• Our KES server policy for the same site as the GSI report:  KLSERVER.klp
• I unfortunately can't be more specific in reproduction steps other than what I have outlined above.

Edited March 11 by dmack

[Ivan.Ponomarev]

Hello!

Have you considered using the KSWS on your servers? 

Thanks!

[mikemcsharry]

I've started to receive the same errors.
One suggestion I saw from a PC user on a general search was to make exclusions in Kaspersky for these lock files, but I don't know what the location of the files will be on a 2012r2 server

 

Does this seem like a reasonable suggestion?

[Nikolay Arinchev]

Hi,

What version of what product do you use?

Thank you!

[mikemcsharry]

Hi Nikolay,

Thank you for any help
Kaspersky Security Centre 10.4.343 on the server.
This shows that 10.2.4.674 running on both the server itself and the one virtual server running on that server.

[Nikolay Arinchev]

Hi,

Unfortunately, KES 10.2.4.674 is not supported anymore. Is it possible to update it to the most recent version?

Thank you!

[Kin]

We have KES 11.0.1.90 and all our 2012 R2 server backups stopped working due to EFI system partition locked.  Only by uninstalling KES will the backup worked.  This started about 2 to 3 weeks ago and affected all 2012 R2 servers on our network.

 

[Dmitry Parshutin]

13 минут назад, Kin сказал:

I have the same backup problem with KES 11.0.1 installed via LogMeIn.   After downloaded and installed the latest KES 11.1.0 from Kaspersky website, Windows Server Backup is working again.

Hello!

In neighbor theme you provided this information.

Is it a solution for you?

Thank you! 

[Kin]

On 3/13/2019 at 7:29 AM, Dmitry Parshutin said:

Hello!

In neighbor theme you provided this information.

Is it a solution for you?

Thank you! 

No.  It stopped working after we rebooted the server after the the KES11 reisntall.  False hope!

 

[Dmitry Parshutin]

3 часа назад, Kin сказал:

No.  It stopped working after we rebooted the server after the the KES11 reisntall.  False hope!

 

Hello!

Is it possible to try KSWS for your Windows server machines?

Thank you! 

[mikemcsharry]

If by KSWS you mean Kaspersky Security centre Web Service, I've just upgraded / installed to this and am struggling a bit.
There's no info / usage links for Security centre 11 (which I think this is) on this page - https://support.kaspersky.com/#s_tab4

I can see that the new net agent is pushing out okay, so I think the console upgrade 10 to 11 has picked up the proxy settings. Where do I check the settings as I can't download the actual endpoint security 11?

Thanks for any help and I'll post here next week regarding backups.

 

[Konstantin Antonov]

My colleague mean the following product - https://support.kaspersky.com/ksws10

Thank you!

[mikemcsharry]

Hi Konstantin,
I've upgraded the Kaspersky management tons on the server from 10, which was a programme, to 11 which is now only a web facility.
I know this is off the initial topic as posted, but I can't find any user config information etc for Kaspersky security centre web service

Thanks for any help

 

 

[Ivan.Ponomarev]

Hello!

What exactly do you mean by the config information? 

Please describe it more exactly.

Thanks!

[Kin]

We get our Kaspersky license via LogMeIn.  KS 10.1.1. for windows server won't activate.  Tried reactivation in LogMeIn doesn't work.

[Nikolay Arinchev]

Hi,

Could you please please provide us with GSI log from that host?

Thank you!

[dmack]

Will licenses for Kaspersky Endpoint Security for Business Select or Advanced work for Kaspersky Security 10 for Windows Server, or will we need new / additional licenses?

[Ivan.Ponomarev]

Hello!

KSWS will work with your license. 

Thanks!

[mikemcsharry]

Hi Konstantin,

Sorry for my late reply.

I have upgraded to KSWS 11 on the server, the server is running version 11 endpoint security and we are still having the same 'lock' issues on UEFI partition and backup is failing.

Is there a way to see if kaspersky is locking this partition? Is there a way to make this partition an exception for kaspersky?

Thank you for any help and ideas

UPDATE.. I rebooted this server overnight, before the backup was scheduled. The backup ran for the first time. It may be that you need to ensure that KSWS, all windows updates and ver 11 endpoint security are in place -and you've rebooted a few times before it all sorts out. If anything changes in my situation, I'll post it here.

 

 

Edited March 20 by mikemcsharry

[Nikolay Arinchev]

Hi,

Thank you for your feedback!

Please keep us updated!

[dmack]

So far, the latest version of KSWS 10.1 ( https://support.kaspersky.com/ksws10 ) has resolved our issues with backups on the hosts we have applied it to for testing. 

KES11.1 is still breaking backups where it is in use on 2012/2012R2 hosts. Once we are sure KSWS10 resolves it we will be switching them all over.

We are monitoring the backup jobs and will report back if the issues return while using KSWS.

[mikemcsharry]

The backup failure has re-appeared since last week. I even paused Kaspersky on the server before attempting a backup.
Ithink my original suggestion may help - the query is ..
How do we make the efi partition an exception on Kaspersky KSWS 11??
I've been reading that the efi partition seems to be given a random letter after reboot, has anyone else found this?

Disk manager on the server shows he efi partition with no drive letter, so I don't know how to make it an exception

 

[mikemcsharry]

I have another installation, where I have just installed KSWS 11 and cannot access it at all from chrome or IE on the server 2012r2.
 

Can I confirm web address for KSWS on server should be 127.0.0.1:8080