FortiEDR crashes PC's with docks attached

2 replies
139 views

We have a strange scenario popping up in the lab for the new EDR deployments we were consulted to explore.

Everything works normally except for when a USB dock is or SD card reader as it immediately crashes the computer

Rebooting the with the dock plugged in will trigger a Bitlocker recovery screen

Reboot without the dock and the computer comes up normally

Removing EDR and leaving EMS resolves the issue, but the computer is unprotected by compliance standards

I suspect the card readers showing up as empty unwritable disks with a mounted drive letter is part of the problem, but not sure how to tell EDR to calm down about it.

The crash:
Your PC has run into a problem

Stop code: System_Thread_Exception_Not_Handled (0x7eE)

What failed: partmgr.sys

Has anyone seen an issue like this before?

Michael_H1

Staff

Hello zoah666,

Thank you for using the Community Forum.
I will try to help find an answer to this problem.
We will reply to this thread with an update as soon as possible.

For now, you might find this article helpful:

https://community.fortinet.com/fortiedr-20/technical-tip-dealing-with-a-windows-bsod-event-105959

Regards,
Michael_H1 – Fortinet Community Team

xshkurti

Staff

@zoah666

Try to do a test by excluding raw/removable volume scanning via EDR
When Device Control or Removable Media Protection features is enabled, it is trying to force-scan or block raw storage volumes.

Open FortiEDR console,
Go to Environment > Security Policies.

Under the policy assigned to your test group, temporarily disable or set to Simulation:

-Exfiltration Prevention - specifically Device Control / Removable Storage Protection

-Ransomware Protection - File System Monitoring / Volume Shadow Copy Protection

Save and fetch the updated policy on the endpoint

Let us know if the bypass does help with crashes