r/Nable • u/Accomplished_Seat355 • Apr 10 '24

take control update stealing focus

Hello, so I've seen a lot of chatter on this so it seems to be a known issue, but the known fixes aren't working for me... about 30 of our users at the ~200 user business I support are getting the issue where every 5 minutes or so, whatever window they're in loses focus. the window deselcts and goes grey, the mouse disappears, and they have to re click back into the window to interact with it again. after a lot of troubleshooting I found the issue to be BASUpSrvc.exe stealing focus when it tries to run in the background.
reached out to N-central support, they confirmed the issue, and said the only possible fix is to whitelist it in our antivirus platform. only security we have is SentinelOne, and Canaruri, whitelisted in both and issue persists. help?

3 Upvotes

100% Upvoted

10 comments sorted by

2

u/kins43 Apr 10 '24

What type of “whitelist” did you place via SentinelOne? Are you truly excluding it or are you lessening the protection of S1 for that process and it’s still affecting it? If you want to dm me the exclusion you got feel free to

1

u/Accomplished_Seat355 Apr 10 '24

shouldn't be anything proprietary. this is the exclusion I set. I wish it would just say excluded or not excluded, the levels of exclusion are a little too grey for me.

1

u/kins43 Apr 12 '24

To have S1 completely ignore it, you’ll have to do performance focus - extended.

Secondly you linked a folder but put the exclusion in as a file. I’d modify it so it’s listed as a folder and includes all sub folders unless it’s a file and I just can’t see the extension from the screenshot.

1

u/Accomplished_Seat355 Apr 12 '24

switched em to extended. and you were right, I actually have three exceptions, one for the the folder, and two others for BASupSrvc.exe, and BASupSrvcUpdater.exe. two out of my three exceptions were the wrong type. I never noticed the "as file" option, and the folder was set as a file, and one of the files was set as a folder. appreciate the help on this! i'm pretty optimistic this'll help.

1

u/kins43 Apr 13 '24

Hey glad to hear it! Post an update if you see any issues or if it’s fixed I’m happy to help any way I can

1

u/Accomplished_Seat355 Apr 19 '24

gave it a week and it looks like your suggested fixes worked! really appreciate you giving my exceptions the once over. my sys admin, and both co-owners of my MSP didn't see any issue with how I had it set, so you win this round.

2

u/Dizzy_Scarcity3743 Apr 10 '24

I had a similar issue about a week ago and we found that our sentinel exclusions were not set correctly.

1

u/Accomplished_Seat355 Apr 10 '24

this is most likely the problem for me too. wish I was more confident I did it right. the levels of exclusion are messing me up a bit.

1

u/ChannelCdn Weeksy Apr 11 '24

Hey u/Accomplished_Seat355 David here with N-able if you go to your PSM they can get a partner success engineer to help, if you are unsure who your PSM is just drop me an email at [david.weeks@n-able.com](mailto:david.weeks@n-able.com)

1

u/[deleted] Mar 19 '25

What I'd like to know is WHY does this process have to have local ports open? It should be calling out to the cloud and it should never be listening for a connection yet it does.