When you install DSA, the ds_agent service does not start. Instead, it crashes immediately and generates a dump file. When you run Windows Debugger on the dump file, the analysis points to an sspicli.dll file, as shown by the following MS debug output:
SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: sspicli+1a11 FOLLOWUP_NAME: MachineOwner IMAGE_NAME: sspicli.dll STACK_COMMAND: ~15s; .ecxr ; kb BUCKET_ID: WRONG_SYMBOLS FAILURE_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE_c0000005_sspicli.dll!Unknown
Based on the analysis, the issue is caused by an incompatibility among the Citrix application, Microsoft, and Trend Micro. The utilRPC.dll file, which calls the sspicli.dll file, could not hook on to the Citrix DLL (AppInit_Dlls). This makes it unable to load the ds_agent service, causing the service to crash.
To resolve the issue, disabling certain Citrix API Hooks is needed. For reference, use the Citrix KB article How to Disable Citrix API Hooks on a Per-Application Basis, then follow our recommend settings below:
- Remove all previously installed DSAs completely.
- Open the registry and add this registry key to exclude the following images.
Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
For Deep Security 9.0 and earlier versions
For 32-bit
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CtxHook
Value Name: ExcludedImageNames
Type: REG_SZ
Value: ds_agent.exe,coreFrameworkHost.exe,coreServiceShell.exe,notifier.exeFor 64-bit
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\CtxHook
Value Name: ExcludedImageNames
Type: REG_SZ
Value: ds_agent.exe,coreFrameworkHost.exe,coreServiceShell.exe,notifier.exeFor Deep Security 9.5 and above
For 32-bit
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CtxHook
Value Name: ExcludedImageNames
Type: REG_SZ
Value: dsa.exe,coreFrameworkHost.exe,coreServiceShell.exe,notifier.exeFor 64-bit
Key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Citrix\CtxHook
Value Name: ExcludedImageNames
Type: REG_SZ
Value: dsa.exe,coreFrameworkHost.exe,coreServiceShell.exe,notifier.exeIf you do not want to install an Anti-Malware, do not add coreFrameworkHost.exe and coreServiceShell to this key. - Reboot the machine.
- Install DSA again.
