| View previous topic :: View next topic |
| Author |
Message |
paulnus
Joined: 29 Aug 2011
Posts: 17
|
 Posted: Mon Feb 17, 2020 3:31 pm Post subject: PendingFileRenameOperations |
 |
|
Hello,
When starting the "KS Advanced Host Monitor" service, there is a temp file written to C:\Windows\Temp\ that gets created upon service start. This temp file also registers inside the registry as a file that flags the system as needing a reboot via the "PendingFileRenameOperations" within the registry.
Clearly, I will defer to your knowledge about building software and how/when/why this flag is getting set. That said, our update software (Ivanti Endpoint Manager), reads the registry key as indicating the server requires reboot. When this happens, our patches do not get pushed and we go into a continuous reboot cycle.
This particular key will have the value associated of the file that was created on service start.
| Code: | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\PendingFileRenameOperations |
Example filename: ~ip2C97.tmp
Example Registry:
https://imgur.com/a/TkwDZ0K
In order to see the file in question, one must unclick the "Hide protected operating system files (Recommended)" checkbox.
My question is, is there a reason the "PendingFileRenameOperations" needs to be set? What exactly is it trying to rename? |
|
| Back to top |
|
 |
KS-Soft
Joined: 03 Apr 2002
Posts: 12795
Location: USA
|
| Posted: Mon Feb 17, 2020 3:47 pm Post subject: |
|
|
I have no idea, HostMonitor should not do this.
This happens every time you start service?
HostMonitor version?
Where did you get this HostMonitor? Downloaded from our web site? Downloaded from some hackers forum?
Windows? Service Pack?
Antivirus monitor?
Regards
Alex |
|
| Back to top |
|
|
paulnus
Joined: 29 Aug 2011
Posts: 17
|
| Posted: Mon Feb 17, 2020 4:03 pm Post subject: |
|
|
The registry updates every time the service is restarted. If you stop the service, the temp file disappears but the registry entry remains. If you restart the service, the filename changes to a different random filename. The .tmp file is not able to be deleted due to it being locked by Host Monitor.
Downloaded from your website. Enterprise license.
I'm actually transitioning my server from a 2012R2 server to a 2019 server. Both instances have the same issue. The patching software we are using is new to us, so its not something we would have noticed before today.
version: v11.99
windows: Windows Server 2012R2
version: v12.24b
windows: Windows Server 2019
If I open the .tmp file and review contents there is this blurb at the end.
| Quote: | | I P * W o r k s ! C + + E d i t i o n . . |
*EDIT*
We are running an anti-virus but I don't feel comfortable sharing publicly. I will check the backend to make sure nothing getting blocked on the server but no alarms went off, which we typically would see. |
|
| Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002
Posts: 12795
Location: USA
|
| Posted: Mon Feb 17, 2020 4:21 pm Post subject: |
|
|
Oh, this is one of the few 3rd party libraries we use.
I though we fixed this issue years ago. Will check how it came back..
Regards
Alex |
|
| Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002
Posts: 12795
Location: USA
|
| Posted: Thu Feb 20, 2020 4:47 am Post subject: |
|
|
Fixed in version 12.26, will be available in couple days
Regards
Alex |
|
| Back to top |
|
|
paulnus
Joined: 29 Aug 2011
Posts: 17
|
| Posted: Tue Feb 25, 2020 4:20 am Post subject: |
|
|
Thanks Alex!
PS - The upgrade fixed the issue. Confirmed. |
|
| Back to top |
|
|
KS-Soft
Joined: 03 Apr 2002
Posts: 12795
Location: USA
|
| Posted: Tue Feb 25, 2020 7:13 am Post subject: |
|
|
You are welcome
Regards
Alex |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in
