During the installation of ENS, there might be services that have ENS modules loaded into their memory space. You might need to shut down and restart these services. The restart is needed to unload those modules, so the installation process can replace them. The Windows Restart Manager, on behalf of the MSI installer, cycles those services. You can observe the cycling through the Windows Application log or the MSI installation log of the respective ENS component.
For example, Antimalware Scan Interface (AMSI) integration is available in ENS. Services that are restarted could have modules related to the AMSI scan functionality loaded into their process space.
Problem
Windows Restart Manager restarts non-critical services during the ENS installation process. A list of non-critical services that might be restarted during the ENS installation is included below:
DHCP Client
Network List Service
Network Location Awareness
SQL Server (MSSQLSERVER)
TCP/IP NetBIOS Helper
WinHTTP Web Proxy Auto-Discovery Service
Windows Connection Manager
Windows Event Log
The list isn't complete. It depends on the state that the services were in, and whether any ENS modules (*.dll) were loaded by those services and thus needed replacing as part of the ENS installation process.
NOTE: Critical system services (services that wouldn't be subject to restart) in this context refers to services that Microsoft has identified as essential for the core operating system stability. For more information, see the Microsoft Restart Manager documentation.
Using the Common module of ENS as an example, the MSI installation log file McAfee_Common_Install_<timestamp>.log records the activity of the Windows Restart Manager:
MSI (s) (C0:FC) [
The Windows Application log also logs these activities. The installation log and the Windows Event Log must correlate to the same time:
INFORMATION MsiInstaller None 1040 SYSTEM Beginning a Windows Installer transaction: C:\ProgramData\McAfee\Common Framework\Current\ENDP_GS_1070\Install\0000\McAfee_Common_x64.msi. Client Process Id: 3348.
The ENS Common module starts its installation through MSI. ...
INFORMATION Microsoft-Windows-RestartManager None 10002 SYSTEM Shutting down application or service 'WinHTTP Web Proxy Auto-Discovery Service'.
A service needs restarting due to this process loading ENS modules that require replacement. ...
INFORMATION Microsoft-Windows-RestartManager None 10003 SYSTEM Restarting application or service 'WinHTTP Web Proxy Auto-Discovery Service'.
The service is successfully reported as being restarted.
System Change
You've upgraded ENS recently.
Cause
The ENS Threat Prevention and ATP AMSI features are enabled in the environment. When the AMSI feature is enabled, several DLLs or modules are loaded into third-party processes. The DLLs or modules need to be unloaded at installation time so they can be replaced.
Solution
This behavior is as designed.
Workaround
Perform the following 'Restart Manager' registry change steps to enable the key "DisableAutomaticApplicationShutdown" during the ENS install and to rotate the changes post ENS deployment. This change disables 'Restart Manager' from automatically shutting down applications and services.
Open the Registry Editor.
Navigate to the path HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer.
Select the value DisableAutomaticApplicationShutdown.