Microsoft Teams Crashes with Fleet/osquery Agent running on Windows Computers

[MDCAllan]

About 2 months ago we started getting reports of the Teams app randomly closing(crashing?) on computers in our environment. We traced the problem to the fleet/osquery agent deployed to the computers. When we disable the LauncherSoLauncherSvc on computers, Teams works normally without randomly closing/crashing.

I was expecting this was probably going to be a temporary bug that would get discovered and resolved along the way, but so far, the problem persists.

I'm wondering, has anyone else had this problem, and is there a way to resolve it without disabling the agent service? Also, where would I go to report a bug related to this service? I am already in contact with Microsoft to work the problem, and they are looking into it from their end, but I'd like to get eyes on the problem from the other side as well.

Thanks for any ideas/input!

Regards,
Eric

[defensivedepth]

Do you have any scheduled queries in place? That is the most likely culprit. If you have a few, you can start disabling them one by one until the system is stable.

[MDCAllan]

Interesting... We have 2 "policies" configured. I'll try disabling those and see if things improve.

Thanks for the idea!

[PatWhitlock]

We have also been having this issue since around early October. So far we have not found a solution outside of removing the osquery agents from our machines. We were also hoping it would be a temporary bug but we still haven't had any luck.
The problems started right after a windows update came out. We contacted Microsoft about the issue but they never came back with a solution.

[MDCAllan]

Thanks very much for sharing this! That timing sounds almost dead-on when we started having problems. I am somewhat relieved to hear that our environment isn't alone in experiencing this problem. I am in contact with MS about it and they are working on trying to understand/solve the problem.

[defensivedepth]

@PatWhitlock @MDCAllan If possible, can you please share what scheduled queries you have running? Also, I would suggest checking in with the osquery Slack - https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw

[MDCAllan]

Hi defensivedepth!

We have only configured "Antivirus healthy (Windows)" and "Full disk encryption enabled (Windows)" using the included templates. We could do without the antivirus check, I just enabled it because it looks good from an audit perspective, but truthfully this is handled with enforced group policy anyway so it's not like we have compliance issues in this area. The Disk encryption is manually provisioned so having a way to track if we did our job during system provisioning is important.

[defensivedepth]

Ok, understood. Have you tried posting about this over in the osquery Slack I linked to?

[MDCAllan]

Hi defensivedepth,

Sorry I haven't had a chance to join over there or post this. MS is looking into this still so I'm hopeful we might have a resolution come down the pipe in the form of a Team or Windows update.