Discussion of Problems due to Hardened Security

[Suo]

My problems around hardening were finally resolved by an update from Digital Guardian, our data loss prevention software provider. I am now able to run VirtualBox 5.1.4 with Digital Guardian 6.23.0835. If you see dgmaster.sys mentioned in your VirtualBox logs, an old version of Digital Guardian is likely the culprit.

[socratis]

@Suo
Thank you very much for letting us know! It might help in the future.

[socratis]

i got this message o_o

[ahmed111]

Hello,

This is my first time using Virtualbox, I am trying to create a virtual machine to run a Linux OS dist and after i create it i can't run it and it gives me this error messages,

Failed to acquire the VirtualBox COM object.

The application will now terminate.



Callee RC: E_INVALIDARG (0x80070057)

Failed to open a session for the virtual machine lin.

The virtual machine 'lin' has terminated unexpectedly during startup with exit code 1 (0x1). More details may be available in 'E:\Ahmed\VMs\lin\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

i am using Win7 32bit (running the app on Compatibility mode -doesn't run otherwise) no AV installed and disabled Windows defender, i tried to uninstall and reinstall with admin permissions and the problem is still there.

VB version: 5.1.5 r110316 (Qt5.5.1) it is a test build but the problem is still there with the latest stable version.

[HF]

I posted here quite a while back about a hardening issue that was caused by BeyondTruest Software's PowerBroker package.

They have since fixed the problems and if you have PowerBroker and are trying to use VirtualBox, then get PowerBroker v7 or later. The problem was that older versions of PowerBroker had a bad certificate.

[BrianMattey]

Windows 10 Enterprise 1511 build
VirtualBox 5.1.4
SEP 12.1.6 build 7004
Defendpoint 4.0.349.0

RC=-5640 when starting VM - hardening log attached.

Corporate Laptop so I can't disable SEP / Defendpoint to see which is causing the issue.

If I retry the startup after failure the VM will eventually (sometimes after several attempts start OK).

Note as well (and thank you for this) that behaviour with 5.1.4 is much improved. With 5.0.x when the startup failed it hung the GUI and I had to shut down all other VMs to clear the error and then try again and with 6 VMs this was very annoying. With 5.1.4 the interrface does not hang so I can retry individual VMs until they start whilst leaving all others running.

[sau]

Hi
I've been using VBox for some time with W10 and I recently decided to update my pc : windows anniversary update (build 1607) and software (including docker toolbox, therefore VBox)
After the install, VBox didn't work, neither did its Manager.
I've removed manually VBox and installed the latest from Oracle (5.1.4), it fixed the manager, but I still can't start docker.
The problem comes from VBox, as I have the same issue when trying to start a Linux VM through the GUI

Windows 10 Professional build 1607
VirtualBox 5.1.4

code E_FAIL (0x80004005)
component MachineWrap
interface IMachine

[mpack]

I suspect that the devs will not be too interested in investigating problems with Docker. You would need to give them a repeatable problem which they can experience on a standard installation.

[sau]

well, I did replicate the issue trying to start a regular Linux VM (Ubuntu 64bits) from the VBoxManager, cf the screenshot

[mpack]

I don't understand. You installed VirtualBox inside the Docker environment, isn't that correct? VBoxManage is not a separate install, it relies on the installed components.

[sau]

No, Docker Toolbox is a set of tools required to run docker on windows (pre - docker-for-windows)
VirtualBox is embedded in this set, but anyway I installed the latest virtualbox from oracle instead of the "old" one provided in DockerToolbox.
My VirtualBox is not related at all with docker, it's only used by it.

[stentor]

OS: Windows 7 Enterprise SP1
VB: VirtualBox 5.0.26, 5.1.4 and 5.1.51r110417 (VBoxHardening.log attached)
AV: SEP 12.1.6 build 7004 (can't be disabled / Corporate IT -> user-defined Exception for "C:\Program Files\Oracle\VirtualBox\*" didn't help)

For comparison you can find attached logs of a successful start of VB 5.0.20 on the same PC before the AV was switched from McAfee to SEP.

[JPagan]

I just upgraded to Win10; not my choice but the company. I installed VBox 5.1.4 and now I can't start any VMs in headless mode. If I start the VMs with Normal Start they work fine. This happens even on newly created VMs. I get an error message like the below. I am attaching the log.

Failed to open a session for the virtual machine Test_Box.

The virtual machine 'Test_Box' has terminated unexpectedly during startup with exit code -1073741819 (0xc0000005). More details may be available in 'C:\Users\jpagan\VirtualBox VMs\Test_Box\Logs\VBoxHardening.log'.

Result Code: E_FAIL (0x80004005)
Component: MachineWrap
Interface: IMachine {b2547866-a0a1-4391-8b86-6952d82efaa0}

[mpack]

@JPagan: Cylance protect? Sounds like a good candidate.

Is your company aware that Win10 has fairly decent AV built in? Cylance Protect may not be what causes your problem, but I think it's certainly worth testing what happens if it's disabled.

[forge33]

Just started getting this error this morning:

VBoxHardening.png (15.3 KiB) Viewed 3914 times

Win 10 x64 Build build 14393.105