cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
IMPORTANT: Currently some Knowledge Base content may be unavailable. We are working diligently to restore these articles and appreciate your patience.

App Control: App Control Agent shows "Cannot connect to user agent"

App Control: App Control Agent shows "Cannot connect to user agent"

Environment

  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Symptoms

Symptoms Include:
  1. Agent not connecting to console
  2. Running DASCLI commands from CLI results in error "Cannot connect to user agent"
  3. Agent driver or kernel filter driver is not running

Cause

Issue is usually due to one of the agent drivers (parity.exe or parity.sys) not running, or another software program (i.e. anti-virus) is injecting itself and not allowing the agent to fully start.

Resolution

It is common to see a full restart of the endpoint resolve this issue. However, if this does not work:
  1. Reboot endpoint into safe mode, and uninstall the agent there. If the agent is in any visibility or control state, tamper protection will be enabled and you will not have the ability to disable it. Re-install the agent after boot.
  2. If the issue is persistent, gather a Procmon while the issue is happening.
  3. Open a case with Carbon Black Support for further troubleshooting.

Additional Notes

To determine if the drivers are loaded, please run the below commands from an admin CLI:
  • sc query parity (to check for service status; go to services.msc too)
  •  sc query paritydriver (to check for driver status)
  • fltmc (to check if paritydriver is loaded)
  • fltmc instance (to check on paritydriver instances)
     

Related Content

Please see KB: https://community.carbonblack.com/t5/Knowledge-Base/How-to-Collect-a-low-Altitude-Procmon-Capture/ta... for instructions on how to collect a low altitude procmon.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
37