68390: Acronis Cloud Manager: agent services stop and VM management fails due to block by Windows Defender

use Google Translate

Applies to: 

Last update: 26-03-2021

This article applies to: all Acronis Cloud Manager builds.

Symptoms

Acronis Cloud Manager's Agent Service (5nine.Agent.Service.exe) running on the Hyper-V hosts is stopped by Windows Defender Real-time protection feature.

  • Hosts are unreachable from Cloud Manager's Console, and the Agent services are stopping.
  • VM management functionalities do not work, like new VM creation, VM move between hosts, VM settings editing, etc.
  • Backup Jobs fail.

The following error appears in GUI when VM management operations are attempted:

In the Agent logs (5nine.Agent.txt) located on hosts same error will be present:

The module to process 'MdcRefsHelpers.psm1', listed in field 'ModuleToProcess/RootModule' of module manifest 'C:\Program Files\5nine\5nine Manager Datacenter Agent\Modules\MdcRefsHelpers\MdcRefsHelpers.psd1' was not processed because no valid module was found in any module directory.

Cause

The issue is caused by the latest Windows Defender Antivirus definitions update which is blocking our Agent service.

To verify the cause of the issue, check that the PowerShell file 'C:\Program Files\5nine\5nine Manager Datacenter Agent\Modules\MdcRefsHelpers\MdcRefsHelpers.psd1 is blocked by Windows Defender and detected as a malware file under Quarantine History > Quarantined items.

Solution

The new Acronis Cloud Manager build v5.0.21078.3 solves this problem.
New build is available for download from "My Downloads" portal at: https://alt.5nine.com/signinAcronis.aspx

Please update to the latest build: simply install the software on top of the current installation. Agents can be installed locally on hosts from the Installer or use the Add Servers function to detect the hosts from Console and install the Agent service on the hosts once discovered in the Console.

In case updating the product is not an option, use the following workaround on the affected hosts:
1. Open Windows Defender, open the Quarantine History, and under Quarantined items Restore the following file that Windows Defender blocked into the Allowed items:

  • C:\Program Files\5nine\5nine Manager Datacenter Agent\Modules\MdcRefsHelpers\MdcRefsHelpers.psd1

2. Start the Agent service. Service will stop after a few seconds being again blocked by Windows Defender.
3. Go back to Windows Defender > All detected items category.
4. Check that the file is blocked again and Click on "Allow Access".
5. Start the Agent service again. This time it should not be further detected.

Initially, the file is taken out from the Quarantined items only to be detected again and put back to the All detected items from where selecting "Allow Access" is possible and the file is permanently allowed.