972719 - Verify that AV and search indexing is off in build directories on b-2008-ix-*

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[Phil Ringnalda (:philor)]

https://tbpl.mozilla.org/php/getParsedLog.php?id=34634442&tree=Mozilla-Inbound is exactly what happens on your first build on a new Windows box, before someone reminds you that you need to tell your antivirus, and Windows Defender/MSE, and Windows Search indexing, that they need to stay entirely out of your objdir.

Comment 1

[Armen [:armenzg]]

Attachment: search index

Why u always right? :)

Comment 2

[Armen [:armenzg]]

Attachment: Windows defender

Comment 3

[Armen [:armenzg]]

Hi Mark,
philor noticed that Windows Defender and Search Index are running on the Windows machines we placed on scl3.
Is the set GPO rules different than on SCL1?
Could you please help us debug this?

For the sake of explicitly setting the implications that this causes:
* We will most likely have to disable all the scl3 Windows build machines 
* Have to block moving Windows machines from scl1 until this gets fixed.

Comment 4

[Mark Cornmesser [:markco] OOO 2024/04/15]

There should be no difference. I will dive into this this morning and figure out what is going on there.

Comment 5

[Mark Cornmesser [:markco] OOO 2024/04/15]

After spot checking the w64-ix machines, this appears to be the case across them as well. I am not sure how those were re-enabled after install, but I work on getting GPOs set up to disable those 2 features.

Comment 6

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: indexnotrunning.jpg

Even though the option is checked marked the indexing service is not running. The service, which is wsearch, has been disabled from the machine through a GPO. The easiest way to check is to do a search on the C drive and see if the message in the attachment pops up in the Explorer window.

Comment 7

[Mark Cornmesser [:markco] OOO 2024/04/15]

As far as Windows Defender, I have a GPO ready to go that will disable it. Should I go ahead and apply to it the 2008 OU?

Comment 8

[Armen [:armenzg]]

Could we schedule this first thing in Tuesday morning and coordinate with bhearsum (as buildduty)?
It's Friday and don't have Saturday or New Zealand coverage if something goes wrong.

Comment 9

[Mark Cornmesser [:markco] OOO 2024/04/15]

For sure.

Comment 10

[Mark Cornmesser [:markco] OOO 2024/04/15]

In email got the OK from bhearsum. The GPO has been applied, and the machines should pick up the changes shortly.