Microsoft Security Client - Log off Network

%3CLINGO-SUB%20id%3D%22lingo-sub-2265094%22%20slang%3D%22en-US%22%3EMicrosoft%20Security%20Client%20-%20Log%20off%20Network%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2265094%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20an%20issue%20with%20a%203rd-party%20application%20freezing%20after%20about%206min%20of%20inactivity%20-%20the%20only%20evidence%20in%20the%20Event%20Viewer%20is%20in%20the%20Application%20Log%3A%3C%2FP%3E%3CP%3ELog%20Name%3A%20Application%3CBR%20%2F%3ESource%3A%20Microsoft%20Security%20Client%3CBR%20%2F%3EDate%3A%2010%2F04%2F2021%206%3A30%3A54%20PM%3CBR%20%2F%3EEvent%20ID%3A%205000%3CBR%20%2F%3ETask%20Category%3A%20None%3CBR%20%2F%3ELevel%3A%20Error%3CBR%20%2F%3EKeywords%3A%20Classic%3CBR%20%2F%3EUser%3A%20N%2FA%3CBR%20%2F%3EComputer%3A%20SOLVit-LOAN-01%3CBR%20%2F%3EDescription%3A%3CBR%20%2F%3ELog%20off%20network%3CBR%20%2F%3EEvent%20Xml%3A%3CBR%20%2F%3E%3CEVENT%20xmlns%3D%22%26quot%3B%26lt%3BA%22%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%3CA%20href%3D%22http%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttp%3A%2F%2Fschemas.microsoft.com%2Fwin%2F2004%2F08%2Fevents%2Fevent%3C%2FA%3E%22%26gt%3B%3CBR%20%2F%3E%3CSYSTEM%3E%3CBR%20%2F%3E%3CPROVIDER%20name%3D%22%26quot%3BMicrosoft%22%20security%3D%22%22%20client%3D%22%22%3E%3C%2FPROVIDER%3E%3CBR%20%2F%3E%3CEVENTID%20qualifiers%3D%22%26quot%3B0%26quot%3B%22%3E5000%3C%2FEVENTID%3E%3CBR%20%2F%3E%3CVERSION%3E0%3C%2FVERSION%3E%3CBR%20%2F%3E%3CLEVEL%3E2%3C%2FLEVEL%3E%3CBR%20%2F%3E%3CTASK%3E0%3C%2FTASK%3E%3CBR%20%2F%3E%3COPCODE%3E0%3C%2FOPCODE%3E%3CBR%20%2F%3E%3CKEYWORDS%3E0x80000000000000%3C%2FKEYWORDS%3E%3CBR%20%2F%3E%3CTIMECREATED%20systemtime%3D%22%26quot%3B2021-04-10T08%3A30%3A54.5764042Z%26quot%3B%22%3E%3C%2FTIMECREATED%3E%3CBR%20%2F%3E%3CEVENTRECORDID%3E4819%3C%2FEVENTRECORDID%3E%3CBR%20%2F%3E%3CCORRELATION%3E%3C%2FCORRELATION%3E%3CBR%20%2F%3E%3CEXECUTION%20processid%3D%22%26quot%3B0%26quot%3B%22%20threadid%3D%22%26quot%3B0%26quot%3B%22%3E%3C%2FEXECUTION%3E%3CBR%20%2F%3E%3CCHANNEL%3EApplication%3C%2FCHANNEL%3E%3CBR%20%2F%3E%3CCOMPUTER%3ESOLVit-LOAN-01%3C%2FCOMPUTER%3E%3CBR%20%2F%3E%3CSECURITY%3E%3C%2FSECURITY%3E%3CBR%20%2F%3E%3C%2FSYSTEM%3E%3CBR%20%2F%3E%3CEVENTDATA%3E%3CBR%20%2F%3E%3CDATA%3E0x1%3C%2FDATA%3E%3CBR%20%2F%3E%3CDATA%3EProtectionManagement%3C%2FDATA%3E%3CBR%20%2F%3E%3C%2FEVENTDATA%3E%3CBR%20%2F%3E%3C%2FEVENT%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20run%20Malwarebytes%20Endpoint%20which%20is%20registered%20in%20'Virus%20%26amp%3B%20threat%20protection'%2C%20so%20unsure%20if%20we%20need%20to%20be%20registering%20this%20application%20as%20an%20exception%20in%20things%20like%20AppGuard%20or%20Tamper%20Protection%20or%20somewhere%20in%20Defender%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2265094%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDefender%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%2010%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
New Contributor

We have an issue with a 3rd-party application freezing after about 6min of inactivity - the only evidence in the Event Viewer is in the Application Log:

Log Name: Application
Source: Microsoft Security Client
Date: 10/04/2021 6:30:54 PM
Event ID: 5000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: SOLVit-LOAN-01
Description:
Log off network
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft Security Client" />
<EventID Qualifiers="0">5000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2021-04-10T08:30:54.5764042Z" />
<EventRecordID>4819</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>SOLVit-LOAN-01</Computer>
<Security />
</System>
<EventData>
<Data>0x1</Data>
<Data>ProtectionManagement</Data>
</EventData>
</Event>

 

We run Malwarebytes Endpoint which is registered in 'Virus & threat protection', so unsure if we need to be registering this application as an exception in things like AppGuard or Tamper Protection or somewhere in Defender?

1 Reply
Hi! It is not entirely clear from this log what the issue is. In terms of AppGuard, it does not require MDE so the two should not be related. I would recommend creating a customer support case via their support channel or providing some additional context or information here.