When attempting to do an agent based compare in Recovery Manager for AD, if the domain controller is running McAfee VirusScan Enterprise, the domain controller becomes unresponsive and has to be hard booted.
This is caused by an issue with the buffer overflow component within McAfee VirusScan Enterprise 8.0i locking the lsass.exe during this type of restore.
Resolution 1:
Disable buffer overflow as per the following instructions:
1. Open Device Manager
2. Click on View and select Show hidden devices to enable
4. Expand Non-Plug and Play Drivers
5. Double-click on ENTDrv5x (where x can represent any number)
6. Select the Driver tab
7. Change the Startup Type to Disabled
8. Reboot
Resolution 2:
Upgrade to McAfee 8.5.0i as this version has major changes to the buffer overflow component which makes it not interfere with the RMAD restore agent, process ERIAgent.exe.
Affects all versions of Recovery Manager for AD.
