IIS Restart causes 100% CPU and K2 Management not to load with Could not load file or assembly errors

Hi,

I can confirm this behavior in several customer environments. K2 Management, Designer, and Workspace take about 5 minutes to load, and Workspace often crashed with an error stating that it could not load various assemblies.
The common factor seems to be Microsoft Defender ATP; adding exceptions to real-time protection for the folders where K2 is installed and for K2 processes helped us resolve the issue.

Exclude the following folders on the disk:

• %ProgramFiles%\K2
• %ProgramData%\SourceCode\Temp
• %AllUsersProfile%\Microsoft\Crypto\RSA

And exclude the following processes (K2 Server, K2WTS, and IIS):

• “C:\Program Files\K2\Host Server\Bin\K2HostServer.exe”
• “C:\Program Files\K2\Token Service\Bin\K2TokenService.exe”
• “C:\Windows\System32\inetsrv\w3wp.exe”

Perhaps this exclusion is too broad and could be narrowed down further, but I didn’t have time to look into it more closely.

This list is based on old support tickets from when issues related to something being blocked or performance were being addressed.

Maybe someone from Nintex could clarify this so that security specialists at companies aren’t too unhappy with the scope of these exceptions.

After applying these exceptions, K2’s response time improved dramatically, with the site loading in about 10 - 15 seconds after an iisreset.

Otherwise, for the K2 web app pool, I don’t use the same account as for the K2 Server service, but a separate domain account that has only standard Domain User permissions on the server. That’s why I wasn’t too worried about the w3wp.exe exceptions, and nothing else is running in IIS on the server.

We haven’t had to deal with any antivirus exceptions in a long time, but now they seem to be coming back.

I'm curious to see if anyone else will contribute something useful and valuable to this thread.

Thanks Pavel.  I’m still a little hesitant to exclude w3wp.exe.  I have logged a ticket with Nintex to get their recommendation as well.

Please keep us updated on your findings, ​@Timkn . I’m experiencing this issue on some customer servers as well, but not all. I haven’t determined yet what is common between the servers that have this issue.