DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 2792121 - Last Review: December 17, 2012 - Revision: 7.0

Symptoms

On Windows Server 2008 R2 SP1 Remote Desktop Services (RDS) servers running the App-V RDS client version 4.6.1.30151 and Forefront Endpoint Proection (FEP) Malware version 3.X, App-V applications stop working after 2-3 days and a reboot is required to restore App-V functionality. The following error may also be logged in the App-V client's sftlog.txt file:

[12/06/2012 11:18:21:968 INTF ERR] {tid=1194}
The Application Virtualization Client has encountered a serious error.  All applications
deployed through the Application Virtualization Client have been terminated.  Please stop the
Client, copy the sftfs.etl file in the installation directory to a safe
place, and contact Technical Support.

[12/06/2012 11:18:22:077 TRAY ERR] {tid=5368:usr=JohnB}
Snagit 10 10.0.0.788

An unexpected error occurred. Report the following error code to your System Administrator.
Error code: 46175B3-00000000-000000C3

NOTE Non-App-V applications are unaffected.

Cause

This can occur if the Forefront Endpoint Protection (FEP) Malware program MsMPEng.exe is scanning the App-V client's virtual drive. By default this is the Q: drive but it could be any drive configured during App-V client installation.

Resolution

To resolve this issue, update the FEP agent to Version 4.1.522.0 or higher and verify that the App-V virtual drive (Default is Q:) is defined in the FEP exclusion policy. Use the steps outlined in the More Information section to verify with Process Monitor that MsMpEng.exe is no longer scanning the Q: drive. For example, if FEP is monitoring the Q: drive you will see entries similar to the following:

7:34:08.3177871 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 32,768, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3179787 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 65,536, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal
7:34:08.3185970 PM MsMpEng.exe 832 ReadFile Q:\defapp\DefaultApp.exe SUCCESS Offset: 98,304, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal


More information

How to run Process Monitor (ProcMon) inside the App-V virtual environment: http://blogs.technet.com/b/appv/archive/2012/04/24/how-to-run-process-monitor-procmon-inside-the-app-v-virtual-environment.aspx. (http://blogs.technet.com/b/appv/archive/2012/04/24/how-to-run-process-monitor-procmon-inside-the-app-v-virtual-environment.aspx)

2576031 Recommended antivirus or antimalware exclusions when troubleshooting Application Virtualization (App-V) client issues
http://support.microsoft.com/kb/2576031/EN-US) (http://support.microsoft.com/kb/2576031/EN-US)

Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See Terms of Use (http://go.microsoft.com/fwlink/?LinkId=151500) for other considerations.

Applies to
  • Microsoft Application Virtualization 4.6 for Terminal Services Service Pack 1
  • Microsoft Application Virtualization 5.0 for Terminal Services
  • Microsoft Forefront Endpoint Protection 2010
Keywords: 
KB2792121
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support