[22h2] NETIO.SYS in one location

[Rydema]

Morning all

 

Having a weird issue in one of our locations.

 

Currently the setup is Unifi 6 Pro AP in one office (that we are hiring) connected to a dream machine.

 

The issue in question is that every so often a whole range of laptops (HP Elitebooks, Probooks, ASUS Elitebook) with a range of different wifi adaptors (Realtek, Intel) all seem to BSOD with the error of driver irql less or equal with the suspected file being NETIO.SYS

 

However, we have another site that uses U6 Pros and myself and the company who run the IT there are both scratching our heads because we are unsure what is causing it.

 

The state of the laptops are that they are up to date with drivers, bios and windows - we run Sophos AV and iBoss filtering. The office use a VPN (Cisco Secure Connect 5) to connect to our datacenter and to all school networks.

 

Heres the kicker: we changed out the AP to an OLDER model which I think is even below the 5 and AC HD models. The issue disappeared. The Company ordered a brand new U6 Pro and the issue returned...

 

It always fails on the same section on the memory.dmp file.

SYMBOL_NAME:  NETIO!StreamInvokeCalloutAndNormalizeAction+5cMODULE_NAME: NETIOIMAGE_NAME:  NETIO.SYS

This issue has been going on for 2 weeks and fast approaching 3

[DrCheese]

Hi - Do you use netsupport? If so, get in touch with them for a fix. It's likely their filter driver conflicting with Sophos.

 

You can also raise this with Sophos, they'll want the memory.dmp from within C:\Windows but they also have a version that might help.

[Rydema]

Hi DrCheese

 

Thanks for coming back to me, we were in the process of getting one of their software in place but its not officially rolled out yet so that can be ruled out

 

However most places like you say point to 3rd Party AVs - The only thing that puts me off this, we have a U6 Pros in other site and have had no mention at all of issues. It's literally isolated to one location (doesn't even happen when users are WFH)

[DrCheese]

I don't think it's your wireless points that are causing this, only because we've had a similar bug recently with the same crash reason that was caused by Sophos interacting with Netsupport - But it can also occur if you have other AVs or security software installed (eg Defender in passive mode)

 

SYMBOL_NAME: NETIO!StreamInvokeCalloutAndNormalizeAction+5c

 

MODULE_NAME: NETIO

 

IMAGE_NAME: NETIO.SYS

 

STACK_COMMAND: .cxr 0xfffff5084b2c5160 ; kb

 

BUCKET_ID_FUNC_OFFSET: 5c

 

FAILURE_BUCKET_ID: AV_NETIO!StreamInvokeCalloutAndNormalizeAction

 

OS_VERSION: 10.0.22621.1

 

BUILDLAB_STR: ni_release

 

OSPLATFORM_TYPE: x64

 

OSNAME: Windows 10

 

https://support.sophos.com/support/s/article/KB-000045942?language=en_US (This says Termind but their support agent said it happens with other software also)

 

I would try raising a ticket with them first, sending them the dmp file and seeing if they can rule it out first - Sophos has form with us causing netio.sys crashes in the past (I remember it doing it a few years ago) hense why focusing there.