Senso and ESET Protect BSOD

[Quinn]

Hello,

 

I have found out the hard way and wanted to share this information to see if this might help anyone else.

 

During the summer we got onboard with Senso, coming from Impero. Software does seem like it worked well and so we pushed the client out to all devices.

During the same summer we also upgraded to ESET Protect, which is also fully cloud.

 

Not long after doing this and all staff returning we have discovered that the devices which both software were installed on started to Bluescreen randomly. And by randomly i mean literally no correlation with anything the staff members are doing.

After many attempts to fully update, reinstall driver packages and resetting the devices the bluescreening would always come back straight away.

 

After extracting the crash logs it looks like it came back to a possible issue with NETIO related to the ESET client.

 

I then contacted ESET support to see if we could get this resolved.

 

ESET then responded with the following

"Do you run Senso in your environment? This is a known issue causing BSOD with ESET currently and we are still investigating and working with Senso Support to identify the issue and provide a workaround/solution."

 

upon finding this out we liaised further with Senso and ESET to come to the following workaround;

 

Disable the WFP Driver within Senso - This will resolve the issues at the expense of the following features;

Dedicated Teacher Machine - https://support.senso.cloud/support/solutions/articles/79000116254-dedicated-teacher-pc

 

Broadcast Screen – The options to select their own screen as “my computer” , you can add the teachers device to the group which will allow you to select the teachers device to be broadcasted.

 

Website logs and control – We will not be able to record any visited URL’s nor we will we be able to control website access with block web etc.

 

Application Control – Application logs will in fact still collect, however you will not be able to apply restrictions around what users can access

 

Any element of Senso that will require packet \ IP level inspection will fail as this is what the WFP driver is used for, this is a complete list of functions you would lose when disabled.

 

Upon applying this to a staff senso group, this was automatically disabled by senso and the devices have now seemingly cleared up, I'm only a few days in but will update if this is still an issue.

 

This is the script they inputted into senso as a batch file under policies;

 

$BlankFile = "c:\program files\renato\senso.cloud\disablefilter"$FileExists = Test-Path $BlankFileif($FileExists -eq $True){Return}else {New-Item -path "C:\program files\renato\senso.cloud" -Name "disablefilter" -itemtype file}Start-Sleep -s 10Restart-Service "senso.cloud.service"

 

Hope this helps anyone out who may be in the same situation - Senso support can do all of this for you if you need help.

At the time of me writing this there is still no fix and they seem to be pointing fingers at each other being the issue.

 

Our hardware was Surface pro 7,8,9 Running windows 10 and 11 fully updated.

 

Cheers,

Quinn

 

 

[HarkNowHear]

We have seen a lot of devices blue-screening in recent weeks. Had suspected a dodgy update however we do use Senso and have previously had similar issues with the WFP driver causing issues with Sophos so wonder if it's a combination of the two screwing us over again. Grrr.

[Quinn]

damn, sounds like it. Glad I'm not the only one fighting with it. Hopefully they find a permanent fix soon.

[DWilson1997]

We have also had a lot of devices randomly BSOD over the past could of months (however we are not Sophos.) Removed everything except senso cloud - thanks for this

[LewRichAIM]

Thanks for this, we have been suffering with this for weeks. Like you we thought it was Windows Updates. We were getting it when connecting peripherals e.g. HDMI, USB etc. The script above is in slightly the wrong format it needs to be like this:

 

$BlankFile = "c:\program files\renato\senso.cloud\disablefilter"

$FileExists = Test-Path $BlankFile

if($FileExists -eq $True){

Return}

else {

New-Item -path "C:\program files\renato\senso.cloud" -Name "disablefilter" -itemtype file}

Start-Sleep -s 10

Restart-Service "senso.cloud.service"S

 

Then deployed using the remote script module as PS1.

 

Thanks again! We now have this rolled out, fingers crossed this cracks it! Interestingly we don't use ESET we use MS Endpoint.

Edited March 27, 2024 by LewRichAIM

[Quinn]

just an update - 1 month later and the devices have not had a bluescreen since.

[falko1]

Just at had a bunch of blues screens today. Came here looking for clues. Was also thinking it was Windows updates maybe.

We use senso and sophos so I'll now be looking into this!!

[Quinn]

Update to this issue directly from Senso;

 

This morning, Wednesday, April 17th, we have conducted an update to our WFP driver set. This update is aimed at resolving compatibility conflicts with third-party systems. We kindly request that you retest any outstanding issues after ensuring that the devices have been successfully updated.

 

Kind Regards,

Quinn

[Frodo_Baggins]

Just at had a bunch of blues screens today. Came here looking for clues. Was also thinking it was Windows updates maybe.

We use senso and sophos so I'll now be looking into this!!

 

Senso have said Sophos is a separate issue - Our BSOD is Netio.sys which I thought was related to the WFP driver from previous issues

Just trying to log a ticket with Sophos - they did post this last month https://support.sophos.com/support/s/article/KB-000045942?language=en_US

 

[DWilson1997]

We don't use Sophos but still having the same issue even after the senso update with NETio.sys - I was hoping the WFP driver would fix our issues too, but Bitdefender have fully looked into for a few weeks and confirmed it is nothing to do with their AV.

[falko1]

Thanks, my team seems confident that disabling Senso stops the netio.sys bsod as the issue does not seem to return.

[Quinn]

Update - Senso has confirmed this issue has been resolved with their latest versions.