Problem Statement:

Users may face login failures, application launch failures, or delayed login time with Accops HySecure and Accops Workspace client on Microsoft Windows OS.


Issue Symptoms:

  • The latest Microsoft Defender update KB2267602 (Version 1.421.1647.0 for Win 10 & Version 1.421.1648.0 for Win 11), released on February 1, 2025, is causing issues with the Accops Client.
  • Affected users are experiencing delayed connections and intermittent login failures while accessing the HySecure gateway.
  • Verify in your latest Windows updates under Definition updates > Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.421.1647.0 for Win 10 & Version 1.421.1648.0 for Win 11) Installed on 01st Feb 2025.



Impacted Client Versions:

Client Version(s) Impacted
Accops HySecure client for Windows OSYes - All Versions
Accops Workspace client for Windows OSYes - All Versions
Accops HyID (Credential provider with pre-login connectivity) for Windows OSYes - All Versions
Accops HyID (Credential Provider only) for Windows OSNone of the versions are impacted
All other Accops clients on all other Operating SystemsNone of the versions are impacted


Root Cause Analysis:

  • The latest Windows Defender update appears to have increased scrutiny over file access patterns and I/O operations. It seems Windows Defender is throttling frequent write operations in a log file stored in User's home directory, temp directory and Windows temp directory.
  • Accops client for Windows stores logs files in User's home, temp and Windows temp directory. 
  • The new behavior of Windows Defender has impacted the event logging process of affected Accops clients for Windows OS, causing significant delays in the overall client operations.
  • Because of the new behavior of Windows Defender, users may face problems in signing in and launching application.


Temporary Workaround:

Following workarounds are the solutions for the problem:

  1. Exclude Accops Folder from Windows Defender (Recommended, as it prevents interference with logs and system functions).
  2. Change file permissions of Accops Log Files to Read-Only (This ensures log integrity but may limit further logging). 

Detailed steps for each solution are provided below:


Solution 1: Exclude Accops Folder from Windows Defender (via GPO) (Recommended)

To exclude Accops-related folders from Windows Defender using Group Policy Object (GPO):

Steps to Apply in Group Policy (GPO)

  1. Open Group Policy Management Console (GPMC)

    • Run gpmc.msc to open the Group Policy Management Console.
  2. Edit or Create a New GPO

    • Navigate to:
      Computer Configuration > Administrative Templates 
      Windows Components > Microsoft Defender Antivirus > Exclusions
      
  3. Configure the "Path Exclusions" Policy

    • Double-click "Path Exclusions".

    • Set the policy to "Enabled".

    • Click "Show…" and add the following paths in the Value name field:

      C:\Users\*\AppData\Local\Accops\edc\softclient\*.log
      C:\Windows\Temp\ACCOPS\*.log
      C:\Users\*\AppData\Local\Temp\ACCOPS\*.log
      
    • After adding the paths, set the Value as 0.

    • Click OK and Apply.

  4. Force Group Policy Update on Client Machines

    • Run the following command on the client machines to apply the policy immediately:
      gpupdate /force
      
  5. Verify the Exclusion in Windows Defender

    • Open Windows Security (Windows Defender).
    • Navigate to:
      Virus & threat protection > Manage settings > Exclusions
      
    • Ensure that the exclusions appear in the list.

Solution 2: Set Log Files to Read-Only Mode

Follow these common steps to set a file or folder to Read-Only Mode:

  1. Press Windows + R to open the Run dialog.
  2. Type the respective file or folder path and press Enter.
  3. Locate the file or folder.
  4. Right-click on the file or folder and select Properties.
  5. Under the Attributes section, enable the Read-only option.
  6. Click Apply, then OK.

Apply the above steps to the following files and folders:

a. Workspace Client:

  • %temp%\ACCOPS\uaclog.log
  • %localappdata%\Accops\edc\softclient\logs\EDCLauncher.log

aa. Additional files to be set in Read-Only mode:

  • %temp%\ACCOPS\HySecurelib.log
  • %temp%\ACCOPS\epslib.log
  • %localappdata%\Accops\edc\softclient\logs\EDCLauncherAdv.log (If MSRDC is in use)
  • %localappdata%\Accops\edc\softclient\logs\edcService.log
  • %localappdata%\Accops\edc\softclient\logs\uilogs.log
  • %SystemDrive%\Windows\Temp\ACCOPS\procmon.log (Needs admin rights)

b. HyID Cred Provider w/ Pre-Login (No impact on Tray Agent or Pure Cred Provider):

  • %SystemDrive%\Windows\Temp\ACCOPS\uaclog.log
  • %SystemDrive%\Windows\Temp\ACCOPS\epslib.log
  • %SystemDrive%\Windows\Temp\ACCOPS\HySecurelib.log

bb. Additional files to be set in Read-Only mode:

The same files as listed under section aa. above should also be set in Read-Only mode.

Next Steps:

Accops is actively working on a permanent workaround for this problem. We have also opened a case with Microsoft regarding the unexpected change in the behaviour of Windows Defender.


Revision Table:

VersionChanges MadeDate
1.0Initial advisory document published.

Feb 1, 2025 (Saturday)

1.1Document updated with Additional Workarounds
Feb 4, 2025 (Tuesday)
1.2Link added to download batch file for quickly applying Solution 1Feb 4, 2025 (Tuesday)
1.3Additional updates and reivision to recommended solutionFeb 5, 2025 (Wednesday)
1.4Details of applying GPO policy indicatedFeb 5, 2025 (Wednesday)
1.5Listed only the most viable solutionsFeb 6, 2025 (Thursday)