dsTermServ issue on Windows 10

[Chelon]

We have 3 users who have migrated to Windows 10 and they all have this same issue. The security and management sw installed on the build:-

Cb defense sensor

Forescout secure connector

Windows defender

[r@yElr3y]

I tried to review the crash dump file but it didn't provide much info about the cause of the issue, since I don't have to access to the debug symbols for dsTermserv.exe process and Pulse Secure Engineering team would be one having it. Without that symbolicating the crash file would be very difficult.

All I found is that the exception caused (reason for crash) had some reference to a dependency file (mcvr80.dll).

[Chelon]

Many thanks Ray, is it definitely that file name, as I can't find in on my laptop. Could it be msvcr80.dll?

[r@yElr3y]

Sorry.. it's mscvr80.dll.

Searching on Google reveals that it's Microsoft Visual C++ 2005 SP1 Redistributable Package.

Not sure if the crash was happened since the file was not present. I have seen terminal services and other pulse components like host checker will be pushed along with those dependency files.

Can you please check if the dependency file is present under "C:\WINDOWS\System32" directory on the affected windows 10 machines, if not please download and install and test the behaviour.

32 bit - http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=5638

64 bit - http://www.microsoft.com/download/en/details.aspx?id=18471

[Chelon]

The file wasn't present so I downloaded and ran the 64 bit install. Rebooted and the file still isn't there and still the same issue. Anything else to try?

[r@yElr3y]

Seems that the dependency files were present under C:/Users/<account>/Appdata/Pulse Secure/Pulse Secure Terminal Services Client/Microsoft.CVR80.

Do we see any informational message under Windows Reliability history (do a search for 'view reliability history') after the client crash?

Any luck on adding exception for dsTermserv.exe process on the Antivirus or if possible, please uninstall all Antivirus and check the behaviour.

[r@yElr3y]

What is the VPN server version and dsTermserv.exe version installed on the machine?

Please enable client logs on the VPN server by navigating to Log/Monitoring -- Client logs -- Settings -- Enable Terminal Services, reproduce the issue and provide the debuglog from C:/ProgramData/Pulse Secure/Logging directory. If the logs were missing or not updated, please check under C:/Public/Pulse Secure/Logging.

[zanyterp]

thank you for confirming that it is happening for the three users that have been migrated. unfortunately, we are not able to see this in our lab on a vanilla image.

as r@yElr3y mentioned, adding dsTermServ.exe to the whitelist for both Carbon Black & Forescout should be checked. I have seen Carbon Black block our executables in the past. Do either of those applications have logs that record what is being blocked/denied that you can check?

[Chelon]

The dependency file is present in the above folder, it's named msvcr80.dll

Are you talking about a VPN server within Pulse Connect? I only have the separate Cisco VPN client installed on the laptop.

[Chelon]

Also let me check with my corp IT desk if we can add to the whitelists, thanks