I’ve had a look though the FAQ’s, guides and searched the forums but haven’t found anything to help…
I’ve started using Comodo recently but am having a bizarre problem with the security settings. It seems that randomly the entire firewall goes from “Excellent” protection with everything working perfectly to all components switched off.
This usually happens when switching users on the PC (only affecting the administrator login), but occasionally I’ve come back from being at work all day and found comodo on screen pretty much warning me that the PC has no protection at all.
Sometimes when this occurs (although not all the time) none of the compenents can be turned back on and the security level slider is inactive and can’t be changed, meaning a restart to get things working as normal.
Have you tried looking in the logs using event viewer (Control Panel/Administrative Tools/Event Viewer). Look under Application and see if there are any Userenv errors or warnings listed.
I looked through the logs as my first port of call but they show nothing out of the ordinary, so I’m not sure if it’s also stopped logging events and traffic when this happens.
So you have checked event viewer rather than Comodo firewall logs? Just want to make sure there is nothing showing in your computer logs for applications failing to load or user profiles failing to unload properly.
Running Win2003 Server, it installed fine, worked fine for a while. Then when I logged back in via remote-desktop, it shows all the components in red, security is “bad”, and I cant turn them back on.
It appears the firewall is still working at some level, but I’m not sure. The client is surely not working properly though, and I cant afford to reboot it constantly.
If you search around the forums you’ll find there are a number of posts about problems like this with multi-user environment, especially where Fast User Switching (FUS) is utilized. FUS doesn’t impact the W2K-family of users, but the multi-user environment still does. Sometimes, for some users.
It doesn’t seem to impact everyone.
Some XP users found that if they went from FUS to the “classic” logon screen that they no longer experienced these issues. That did not work for all, though.
I think some W2K-family users came up with a work-around solution, but I don’t remember details. It also did not work for everyone (I think it involved Services, but I’m not sure).
It has been reported to Support, and I think they acknowledged being aware of it. There was no word on the cause, as far as I know.
It’s been a while since I’ve come across the issue; probably close to 6 months. Since these reports tend to go in cycles, it may be coming back around…
All the monitoring is off, and protection strength = Bad.
I have to reboot to get it to appear normal.
These are on servers that I remote desktop into.
Ok, I’ve found part of the problem…
The system appears to run 2 processes… CPF.EXE & CMDAGENT.EXE
However…
When I log in via remote desktop, and the system isnt working properly, it appears there are TWO instances of CPF.EXE running.
If I exit CPF (right click & exit), and then terminate the other instance of CPF.EXE via Task-Manager, then I restart CPF it works normally (as it restarts CPF and only 1 instance exists).
So when you use Fast User Switching the CFP running in the account you’re switching from remains active, and when CFP is run a second time it conflicts with the other instance just like two different firewalls would. So it’s not a bug proper in CFP, only that it can’t take FUS as it is now.
I don’t think UPHC would work with the FUS scenario, as it’s the multiple user accounts that’s the issue. There’s no log-off or shut-down occurring for the other/previous user so there wouldn’t be anything for UPHC to do…
I’m not even sure it would work in a “classic” NTFS environment where there’s no FUS at play, simply because there’s no shut-down; even though another user may be logged off (probably not when remote-connecting to a server, though).
I think Japo has a good point; it’s seeing multiple user-instances of CFP.exe as conflicting FWs. I wonder if it would help to change the Ownership Properties of CFP.exe to run on an individual per-user basis. Not sure if it would work this way, but I’m wondering if that would keep each user from seeing every instance of CFP.exe that’s running (via task manager). If each instance is user-defined rather than system-defined. Sorry if that makes no sense, I’m just thinking “out loud.”
What you said makes sense LM (as always). I have not tried out version 3 beta yet but I assume that it will deal better with FUS than the current incarnation?
I think I’ve read users reporting problems, still, but I’m not sure of the details. Unfortunately, it’s not just FUS (or at least not w/2.4) - it’s multi-user environments. Even tho W2K doesn’t have FUS (and XP doesn’t have to use it), problem seems to exist when multiple users are logging in and out; predominantly with the machine staying on.
It does need to be sorted out, IMO. The devs are far better equipped for that than I…
