Issued: 22nd November 2016
Overview of known issue:
Webroot has been actively tracking and monitoring an issue that affects some customers operating Terminal Servers in a virtualized environment. During a fault condition, a Winlogin 4005 error occurs where an RDS user is unable to connect to the RDS server, and the event logs display a message indicating that Winlogin has stopped responding.
Interim advice issued by Webroot engineering teams recommended setting the WSAB Self-Protection function to ‘Minimum’ on all Server Policies as this significantly reduced the frequency of Winlogin 4005 errors in most cases.
Further to that advice, Webroot engineering teams developed a new, stabilizing agent release to address causes of the 4005 error and made this agent available to a select group of customers to trial from 15th November.
This new v126.96.36.199 agent has shown noticeable improvement towards resolution of the 4005 issues with the select group of customers. Given the positive feedback, Webroot made a decision to make this new agent build available to all Webroot customers via ‘Auto updates’ today (Tuesday 22 November). This will eliminate the need for customers to manually install this agent build in in the field and should provide global relief.
Webroot engineering teams continue to complete regression and environment testing on a fix. The engineering and QA teams continue to treat this as their highest priority and are predicting that a new build will be targeted for release in December following in depth analysis of the stabilizing agent.
Following successful roll out of the fix and a suitable review period, Webroot will remove the recommendation to operate Self-Protection at the minimum setting and restore ‘Maximum’ as the default setting.
Webroot Release deployment steps
- Please log into the Webroot GSM management console and confirm the Webroot agent has been ‘Auto- updated (to v188.8.131.52) and is checking in on all machines.
- Webroot will communicate an update to this message on/by Friday 2nd
- If you face issues with 4005 errors, please contact Webroot Support for assistance at your earliest convenience.
The Webroot Product Management Team
Best answer by JGiffard
Working closely with our customers, Webroot has identified an issue that manifests itself in the form of existing Terminal Server sessions becoming un-responsive with users no longer being able to log in. The affected Terminal Servers have required restarting in order for normal service to be resumed. For customers who have experienced this, an update to WSA is available now and Webroot support will provide assistance as required. The fix will also be rolled into the next general release of WSA which is forecast to be automatically deployed in October. Forthcoming product bulletins will advise of the exact date.
To download and install the update with the fix now, you may run the following executable on any server experiencing these issues:
If you experience any further issues, please update your support ticket and the escalation team will get back to you promptly.
Thank you for your patience whilst we have investigated and developed the update. It is deeply appreciated by us all at Webroot.
If you wish to discuss this matter further or just to talk about the direction of WSA in general, please do contact me directly.
Senior Product Manager