Startup Not Allowed - You can only run one instance of SEB at a time.

[sruliwolff]

Hi There,

We are running SEB 3.4.0.480 on Windows 10 in a School Library. This is for EQAO testing in Ontario, Canada.

At first they all had the error: "You can only run one instance of SEB at a time". Error Header is "Startup Not Allowed".

We spoke with EQAO tech support and their only help was to suggest removing all monitoring, management and AV software, which we did. Some worked after removing a lot of software and rebooting, however some didn't work, and we are still having the same issue on them. Their only suggestion at this point, is to re-install windows.

Can you please point me in a way to troubleshoot why this message arises. There are no logs from what I can see, as the software doesn't even load yet.

Thank you

Sruli

[dbuechel]

Yes, one of the very first checks SEB performs is whether another instance is already running. I do not know the details of your infrastructure, but if you're e.g. using thin clients where multiple users are running simultaneously on a server, then that could lead to the above issue.

If that is however not the case, then you'd need to make sure that no other instance of SEB is running. You can do so by opening the Task Manager of Windows and terminating any potentially running SEB instances manually.

[sruliwolff]

Thanks for replying.

These are all individual machines, not thin clients.

We have checked and double checked multiple times and there are no additional instances of seb running. We have also tried stopping the service in case that is causing the issue. And we still have that problem.

Is there anything else it could be?

[danschlet]

I see you answered that those are not thin clients. But when you mentioned a school library, I thought Windows Server might be involved. There this error message occurs.

[sruliwolff]

They are on a domain but are all individual machines. And not running other versions or instances of the software.

…

________________________________ From: "Daniel R. Schneider" ***@***.***> Sent: Wednesday, March 27, 2024 12:09 a.m. To: SafeExamBrowser/seb-win-refactoring Cc: Sruli Wolff; Author Subject: Re: [SafeExamBrowser/seb-win-refactoring] Startup Not Allowed - You can only run one instance of SEB at a time. (Discussion #831) CAUTION: External Email. I see you answered that those are not thin clients. But when you mentioned a school library, I thought Windows Server might be involved. There this error message occurs. — Reply to this email directly, view it on GitHub<#831 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/BHGLUGM7WTONV2TMONJUITTY2HPXVAVCNFSM6AAAAABFCEMPLSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DSMRRGAZDE>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[danschlet]

Well I never understood what Microsoft had in mind with Windows Server, but apparently in many cases people run individual desktop computers connected to Windows Server and for some illogical reason Windows Server actually runs multiple instances of Windows desktop applications which then somehow are served to those desktop clients. We had multiple reports that then people get this SEB error message on those individual clients and just can't understand why (I guess they also don't understand the weird concept of Windows Server).

[dbuechel]

If you're only synchronizing e.g. user profiles, then it should likely not be an issue. However, this is something where we unfortunately can't help much from afar.

You could try to remove a computer from the domain and then see whether it works. If yes, then it indeed has something to do with your domain configuration, otherwise it is an issue with the computers or potentially third-party software or Windows itself.

[RoChess]

Ran into this issue on 3.7.1 for random users and finally (yay) figured out "one" cause and the corresponding solution.

Trend Micro Maximum Protection 17.8 (latest version) was interfering.

Solution was adding SEB executable to exception list.

SEB had no logs at all, and although I forgot to verify Event Viewer, I felt that since SEB showed "You can only run one instance of SEB at a time" it should have been able to write more information in a log file.

[dbuechel]

I felt that since SEB showed "You can only run one instance of SEB at a time" it should have been able to write more information in a log file.

No, because as previously stated, the single instance check is one of the very first operations performed, long before any logging or alike is initialized.

[dbuechel]

I frankly also fail to understand how a "security" software manages to interfere with the single instance verification of SEB (more details would be most welcome out of curiosity).

As a merely personal opinion, I would abstain from the usage of (often snake oil) software promising "maximum security" - it time and again causes exactly such unwanted behavior due to false-positive detection of legitimate applications. In my humble opinion, the default Windows Defender combined with common sense behavior should work just perfectly fine for normal scenarios...

[RoChess]

Totally agree.

GIANT had one of the best enterprise graded protections. So when Microsoft purchased them 20 years ago and integrated it eventually as Windows Defender there was often no need for any third-party solution.

Out of anti-competitive need Microsoft had to leave the door open, and I often find greed sneaking in inferior solutions such as McAfee via affiliation deals with OEMs. But the fight against zero-day is real and it's a constant battle. Although not a virus, the disaster with CrowdStrike never would have happened if EU hadn't blocked Microsoft from securing kernel access more.

I'll reach out to TrendMicro if they can investigate and stop interfering with normal app functionality. Reason I eventually started to suspect it was because I noticed a Google Chrome hook active burried deep, and suspect TrendMicro trying to inject same hook into SEB.

That's what made me wonder if a debug log entry on location of "other instance" would have been possible to make debugging easier as I spent over an hour trying to figure out the culprit through trial-and-error.

Not having direct access to these systems with issues is the frustrating part, because I couldn't do quick checks like Windows Safe Mode (as I would have lost remote access).

But the discovery on TrendMicro misbehaving will help me in the future to narrow down what to look for quicker, and I'm hopeful that sharing it on this issue will help other admins/users.

It was only a couple users on our side, so thankfully the "snake oil" 😂 software is not widespread.

The "unexpectedly terminated" issue remains, but struggling to connect with the users that experience it to have them try your CEF Sample app suggestion.

[dbuechel]

I'll reach out to TrendMicro if they can investigate and stop interfering with normal app functionality. Reason I eventually started to suspect it was because I noticed a Google Chrome hook active burried deep, and suspect TrendMicro trying to inject same hook into SEB.

That would be very good indeed!

Not having direct access to these systems with issues is the frustrating part, because I couldn't do quick checks like Windows Safe Mode (as I would have lost remote access).

That is very understandable and also an issue we often face when trying to provide support.

But the discovery on TrendMicro misbehaving will help me in the future to narrow down what to look for quicker, and I'm hopeful that sharing it on this issue will help other admins/users.

Great, yes that most certainly will be very valuable and helpful for other users, thanks in advance!