System hang with McAfee SolidCore and Endpoint Protection

Products

• Endpoint Protection

Issue/Introduction

After installing McAfee's Application and Change Control product SolidCore with Symantec Endpoint Protection 12.1 client installed, the system hangs at login prompt.  The computers need to be powered cycled to reboot in order for another login attempt.

Cause

There is a product conflict resulting in deadlocks between the McAfee driver (swin.sys) and Symantec driver (symds64.sys).  The issue happens when the Symantec driver detects a file IO and performs an operation involved in a scan.  The McAfee swin driver intercepts our IO and then performs some tasks.  This happens in another thread where the sequence is the opposite and both drivers are deadlocked on each other.

Resolution

To resolve this issue, create the following folder and sub folder exclusions for Endpoint Protection in the McAfee Solidcore product to prevent any interaction with our product.  

• C:\ProgramData\Symantec\Symantec Endpoint Protection\

If not resolved, add the following to the exception setting in Endpoint Protection.

• C:\Program Files\McAfee
• C:\Documents and Settings\All Users\Application Data\McAfee
• C:\Windows\system32\swin.sys