Add McAfee products to the list of security products that do not work well with the latest Windows fixes.

When Microsoft released monthly Cumulative Updates for Windows 7, Windows 8.1, and Server products, no one could have imagined how much these fixes would be a nightmare for many system administrators.

Two days later, Microsoft acknowledged that something was wrong and that the updates caused compatibility issues with some Sophos and Avast security products. Microsoft has added Avast and ArcaBit products to the list of known issues this weekend.

Users and security companies have reported that the startup of some devices may not be successful or that they appear frozen or locked for a long time. The only solution at the time was to uninstall the updates to fix the problem.

Today, Microsoft has added products from another security company, McAfee, to the list of products that did not like the new update.

The release notes for KB4493472 and KB4493446, the cumulative monthly cumulative updates for Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows Server 2012 R2, point to the following problem:

Microsoft and McAfee have identified a problem on devices that have McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 installed. This can slow down the system startup or prevent it from restarting after you install this update.

Microsoft specifically lists McAfee Security (ENS) Threat Prevention 10.x and McAfee Host Intrusion Prevention (Host IPS) 8.0, as well as links to McAfee support articles (here and here).

McAfee provides information about the cause of the problem and it seems likely that it is the same cause for all systems with affected security products.

Changes made in the April 2019 Windows Update for the Client Server Runtime Subsystem (CSRSS) have created a possible hang with ENS.

The solution proposed by the company suggests to system administrators to "disable any access protection rule protecting a service".

Woody Leonard notes – rightly – that "the announcement is strange", Microsoft listing the problem only for cumulative patches, but not for security patches only. Security fixes only list issues with Sophos, Avira, and Avast products only; ArcaBit and McAfee are missing.

Are devices with security patches only and installed McAfee or ArcaBit software also not affected? Woody suggests that it could be a "sloppy documentation"; it would not be the first time that the documentation provided by Microsoft lacked vital information.

Anyway, if you run a business security solution on devices running any of the affected operating systems, avoid the published fixes until everything is settled. At the very least, create a backup on a single computer, apply the update, and carefully monitor the behavior.

Publicity