Operational guide Windows Server

Prepare antivirus and EDR software before you install Gluesync on Windows Server

On Windows Server, Gluesync runs in Windows containers. Antivirus and endpoint detection and response (EDR) products, such as Microsoft Defender or Elastic Defend, can block Docker while it saves the Gluesync images, or end processes inside the running containers. Agree on exclusions with your security team before you install, so the installation does not stop halfway and the containers do not keep restarting.

In this guide

  • Understand why security software affects Windows containers.

  • Recognize the symptoms.

  • Find the security products installed on the host.

  • Add exclusions in Microsoft Defender and in third-party EDR products.

  • Confirm that the containers stay up.

Goal

Install and run Gluesync on a Windows Server host that runs antivirus or EDR software

Audience

Windows Server administrators and the security team that manages the host

Level

Intermediate

Time

30 minutes, plus the time your security team needs to approve the exclusions

Area

Windows Server, Docker Engine, Windows containers, endpoint security

Applies to

Gluesync 2.2 kits for Windows containers

Plan these exclusions before you install. When security software interferes, the errors that Docker shows do not name the security product, so the cause is easy to miss.

Why security software affects Windows containers

Two things make Windows containers sensitive to security software:

  • Docker writes and renames thousands of files while it saves the images. If a scanner holds one of those files open, Windows refuses the rename and the download stops with Access is denied.

  • Container processes run on the host. In the default process isolation mode, Windows containers share the host’s Windows kernel. Every process in a container, such as java.exe, node.exe, traefik.exe, prometheus.exe, and the container’s own CExecSvc.exe, is also a process on the host, where security software can inspect, block, or end it. An exclusion or trust rule for dockerd.exe alone does not cover these processes.

Symptoms

Symptom Where to go next

run.ps1 stops with failed to register layer: rename …​ Access is denied.

Fix "Access is denied" when Docker downloads images on Windows Server

docker ps shows containers as Restarting (3221226010), and the other containers have been up for only a few seconds

Containers keep restarting in this guide

Gluesync starts slowly, uses unexpected CPU, or pipelines lag

Antivirus software in the production readiness guide

Before you begin

  1. A PowerShell session opened with Run as administrator.

  2. A contact in the team that manages security software on the host, with permission to change its policy.

  3. The planned Gluesync installation folder. The default is C:\Program Files\Gluesync.

Guide steps

Find the security products on the host

PowerShell

  1. List the file system filters installed on the host. Security, backup, and replication products each install one:

    fltmc

  2. Compare the output with the following table.

    Filter name What it is

    WdFilter

    Microsoft Defender.

    ElasticEndpointDriver

    Elastic Defend.

    CSAgent

    CrowdStrike Falcon.

    SentinelMonitor

    SentinelOne.

    SysmonDrv

    Microsoft Sysmon. It records file activity and blocks files only when its configuration uses file block rules.

    bindflt, bfs, CldFlt, FileCrypt, FileInfo, FsDepends, luafv, npsvctrig, storqosflt, UnionFS, wcifs, Wof

    Windows components. These are expected on a Windows container host.

    Treat any other filter as a security, backup, or replication product, and identify the product that installed it.

  3. Check whether Microsoft Defender actively scans files or runs in passive mode:

    Get-MpComputerStatus | Select-Object AMRunningMode, RealTimeProtectionEnabled
Expected result

You have the list of security products on the host. AMRunningMode shows Normal when Defender scans files itself, and Passive Mode when another product does.

Add exclusions in Microsoft Defender

PowerShell

Do this step if AMRunningMode is Normal.

  1. Exclude Docker’s data folder, the Gluesync installation folder, and the Docker Engine process. If Docker uses a different data folder or Gluesync uses a different installation folder, use those paths instead:

    Add-MpPreference -ExclusionPath "C:\ProgramData\docker"
Add-MpPreference -ExclusionPath "C:\Program Files\Gluesync"
Add-MpPreference -ExclusionProcess "dockerd.exe"

  2. Check whether Controlled folder access is on. 1 means on:

    Get-MpPreference | Select-Object EnableControlledFolderAccess

  3. If Controlled folder access is on, allow the Docker Engine process after the installer has installed and started Docker:

    Add-MpPreference -ControlledFolderAccessAllowedApplications (Get-Process dockerd).Path

If Defender is managed centrally, for example through Group Policy, Intune, or Microsoft Defender for Endpoint, add the same exclusions in that console. Central policy can ignore or replace exclusions that you add on the host.
Expected result

Get-MpPreference lists both folders under ExclusionPath and dockerd.exe under ExclusionProcess.

Add exclusions in Elastic Defend and other EDR products

Security console

A Defender exclusion has no effect on a third-party product. Ask the team that manages each product listed by fltmc to do the following for this host:

  1. Exclude Docker’s data folder (C:\ProgramData\docker by default) and the Gluesync installation folder from file scanning.

  2. Trust the Docker Engine process, dockerd.exe. In Elastic Defend, add it as a trusted application.

  3. After the first start of Gluesync, review the product’s alerts and events for this host. Look for processes from the containers that were blocked or ended, such as java.exe, node.exe, traefik.exe, prometheus.exe, or CExecSvc.exe.

  4. Add exceptions for the activity that the product blocked. In Elastic Defend, add an endpoint exception for those alerts.

To confirm that a product is the cause, ask your security team to switch this host’s policy from blocking to detection only, for example from Prevent to Detect in Elastic Defend, while you start Gluesync. If the containers stay up in detection mode, the product is the cause, and its alerts show what to exclude. Switch the policy back when the exceptions are in place.
Expected result

Your security team has confirmed the exclusions and exceptions for this host in each product.

Install Gluesync and confirm that the containers stay up

PowerShell

  1. Install Gluesync as described in Windows Server installation.

  2. Wait 10 minutes after the platform starts.

  3. Check the status of the containers:

    docker ps --format "table {{.Names}}\t{{.Status}}"

  4. Check how many times each container has restarted:

    docker inspect --format "{{.Name}} restarts={{.RestartCount}} exit={{.State.ExitCode}}" $(docker ps -aq)
Expected result

Every container shows Up, none shows Restarting, and every line shows restarts=0.

Verify the result

  • The installation downloaded every image without an Access is denied error.

  • Every Gluesync container shows Up and restarts=0 after 10 minutes.

  • The Control Plane opens at https://localhost.

  • Your security team has recorded the exclusions for this host, so that a policy update does not remove them.

Containers keep restarting

When security software ends processes inside the containers, docker ps shows output like the following. Some containers show Restarting, and the others have been up for only a few seconds although they were created earlier:

STATUS                                    NAMES
Restarting (3221226010) 10 seconds ago    gluesync-windows-gluesync-conductor-1
Restarting (3221226010) 10 seconds ago    gluesync-windows-prometheus-1
Up 7 seconds                              gluesync-windows-gluesync-core-hub-1
Restarting (3221226010) 10 seconds ago    gluesync-windows-reverse-proxy-1

Exit code 3221226010 is 0xC000021A: a critical Windows process inside the container ended. Docker starts the containers again because of their restart: unless-stopped policy, so the platform keeps going down and coming back. Third-party containers such as Prometheus, Grafana, Traefik, and Portainer are affected as well as the Gluesync ones, which shows that the cause is on the host.

To find the cause:

  1. Go to the Gluesync installation folder and stop Gluesync:

    .\stop.ps1

  2. Start a plain Microsoft container that contains no Gluesync software, and leave it at the command prompt for 3 minutes:

    docker run -it --rm mcr.microsoft.com/windows/nanoserver:ltsc2022 cmd

    If the container closes by itself, the host stops containers regardless of what runs in them.

  3. Check whether Windows recorded application crashes in the last 15 minutes:

    Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000; StartTime=(Get-Date).AddMinutes(-15)} | Format-List TimeCreated, Message

    Crash events name the process that failed. If there are no events, the processes were ended from outside, which points to security software.

  4. Ask your security team to check the alerts for this host and to apply the exceptions in Guide steps, or to switch the host to detection mode for a test.

  5. Start Gluesync again with .\run.ps1 and repeat the checks in the last guide step.

Troubleshooting

Problem Possible cause What to do

The image download stops with Access is denied

A scanner holds Docker’s files open while Docker renames them

Follow Fix "Access is denied" when Docker downloads images on Windows Server.

Containers show Restarting (3221226010)

Security software ends processes inside the containers

Follow Containers keep restarting.

Exclusions added with Add-MpPreference do not appear, or disappear later

Defender is managed centrally, and central policy does not keep local exclusions

Add the exclusions in Group Policy, Intune, or Microsoft Defender for Endpoint.

The containers stay up, but Gluesync is slow or uses unexpected CPU

Real-time scanning of the Gluesync data and log files

See Antivirus software in the production readiness guide.

Related guides

If the containers still restart after your security team has confirmed the exceptions, collect the logs with collect-logs.ps1 from the installation folder and open a ticket on the support portal. Include the output of fltmc, docker ps -a, and the docker inspect command above.