I had a few reports of IE crashing for some users. I've found this appears to be happening for a lot of VM's. The logs show the following error:
Faulting application name: IEXPLORE.EXE, version: 11.0.15063.850, time stamp: 0x3173cb3d
Faulting module name: vmwsci.dll, version: 7.2.0.21950, time stamp: 0x5910b368
The faulting module (vmwsci.dll) appears it has to do with the View Agent PCoIP Smart Card Interception. Is that the same thing as the Smarcard Redirection feature? We don't even select this for our View Agent installs. It's happening on various versions of view agent (7.0.3, 7.2). It does appear these errors started to occur right after the July Windows and Office updates.
I'd recommend opening a case with Symantec. We had a similar issue with Carbon Black where it was corrupting files. After the team that managed Carbon Black engaged support they were able to resolve it.
Do you have an image before the July Windows/Office updates to test with?
What antivirus and I/O filter drivers are you using? We've seen a lot of issues like this where antivirus or a I/O filter driver are the culprit.
I forgot, we did just update Symantec Endpoint Protection earlier this month, which appears to be at version 14.0 RU 1 MP 2.
I'm also seeing a lot of Audit Failures for this file (vmwsci.dll) regarding code Integrity not being valid:
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=6281
EventType=0
Type=Information
ComputerName= name of vm
TaskCategory=System Integrity
OpCode=Info
RecordNumber=2227863
Keywords=Audit Failure
Message=Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.
File Name: \Device\HarddiskVolume2\Windows\System32\vmwsci.dll
I'd recommend opening a case with Symantec. We had a similar issue with Carbon Black where it was corrupting files. After the team that managed Carbon Black engaged support they were able to resolve it.
It's definitely from the Symantec Endpoint Protection update. I rolled back some VM's to prior version and don't receive this error. The version we are currently on is 14.0 RU1 MP2.
Hi,
We have been experiencing the exact same problem with Symantec Endpoint Protection 14.0 RU1 MP1 Build 3897 on View and RDS 2012 R2.
It certainly seemed to start after the June or July windows updates.
Apart from rolling back have you found any further on resolving this?
Which version did you have success with?
We are going to update to 14.2 to see if this resolves the issues we've been running into. The previous version of 14.0 MP2 (14.0.2455.0206) that we rolled back to didn't seem to have issues.
Thanks for your response. I did have another question that I was wondering you could maybe help with. You mentioned that you ran into issues with CarbonBlack. We are just getting started with this as well. We just deployed this to select machines late June. Starting this Monday, 6 out of the 12 VM's that have the Carbon Black Sensor (version 6.0.3.70821) installed have crashed all at the same time. The dmp file indicates that it's caused by NETIO.SYS.:
BugCheck D1, {10, 2, 0, fffff80a99d27515}Probably caused by : NETIO.SYS ( NETIO!NsiEnumerateObjectsAllParametersEx+224 )
I was just curious what you were running into.
Thanks
I don't manage CB but we've definitely seen this. Get with CB support and verify you are running the best practices for virtual desktops. I remember they had to do something with USN journal in the CB config. If these are linked clones/instant clones you need to make sure the parent is template properly in CB.
Thanks for the reply. Please post your results with 14.2. We are trying to decide whether to upgrade to 14.2 or not.
14.2 Did not fix this.
Thanks for the reply. That is a pity.
In the meantime we have added a scan exception for vmwsci.dll and are monitoring the results. Positive so far.
We have not seen the appcrash since adding the Virus scan exclusion for the VMWSCI.DLL to the policy covering the RDS servers.
Sadly the fault is still occurring with varying regularity.
Do you possibly have another product installed on the VM with a filter driver? If not I would work with your A/V vendor to get it resolved.