topic Re: Multi-User Tray Application in Endpoint Security

AMP User Interface shows "Service stopped" when multiple users are logged in via Remote Desktop Services

tfellinger — Fri, 21 Feb 2020 05:29:57 GMT

Hi,

I have a FireAMP Connector installed on a server with Remote Desktop Services running.

When the first user logs in via RDP the tray agent looks good, green check mark, connected. But when the second user logs in the tray agent displays the error: "Status: Service stopped", but the service is running and the first user is still seeing a green check mark. So this looks like a communication problem between the tray agent and the service in case of multiple users logged in at the same time. I checked this in my lab and it behaves exactly the same.

Is there some special setting one would need to run AMP on a terminal server?

The only workaround I can think of is to disable the GUI, but that's not really a solution.

Thank you!

Hi

yogdhanu — Sat, 07 May 2016 06:01:28 GMT

When you are logged in to a windows machine with more than one user and the FireAMP user interface is enabled, you may see that some users see the UI as "Service Stopped" even though another account shows "Connected" and FireAMP functions correctly.

Only one(1) FireAMP user interface service (iptray.exe) can only connect to the main FireAMP service (sfc.exe) at a time. additional users that log on to a given windows workstation or server will cause an additional UI process to start, but it will appear as if FireAMP is stopped because of single pipe limitation to the sfc.exe service.

It is important to note for users/customers that FireAMP is working properly, and this can be corrected by logging off the logged on user accounts and logging back in, or by killing all instances of iptray.exe from the task manager, and restarting it from the installation directory, or start menu shortcut.

So in the end its expected behavior with AMP

Rate if it helps.

Hello,

tfellinger — Sun, 08 May 2016 20:27:18 GMT

Hello,

thank you for your explanation!

This is probably expected behavior, but in the end a real bad user expierence.

Do you know if there are any plans to make the tray-agent multi-user capable?

Thanks,

Thomas

Multi-User Tray Application

cmh-tyler — Tue, 11 Sep 2018 22:25:04 GMT

Hello All,

Just found this post, which explains the issue I'm also facing. Would be great if the tray app could work for multiple users!

Thanks.

Re: Multi-User Tray Application

Thomas Busch — Tue, 11 Sep 2018 23:09:40 GMT

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc64688 is the current bug tracking this behavior. You may follow the bug to get updates to when the GUI will be able to support multiple user logins.

Re: Multi-User Tray Application

cmh-tyler — Tue, 11 Sep 2018 23:13:12 GMT

Thanks for the quick Reply Thomas, glad to know there is at least a bug created for the issue!

Re: Multi-User Tray Application

viterra_au — Fri, 06 Dec 2019 00:56:04 GMT

Hi Thomas,

Can you please explain how the workaround in the Bug Description is used to resolve the issue? I cannot see anywhere here that prevents the "Service Stopped" message when multiple users log in.

Thank you,

Phil

Re: Multi-User Tray Application

Troja007 — Fri, 06 Dec 2019 08:31:05 GMT

Hello @viterra_au,

the only thing you can do, if there are multiple users logging into one system at the same time, is to disable the tray icon using the AMP policy. As mentioned above, today the sfc.exe process can manage one tray icon connection.

You can talk to your Cisco representative to open a Feature Request for this.

Greetings,

Thorsten

Re: AMP User Interface shows "Service stopped" when multiple

Rameez007 — Thu, 16 Dec 2021 15:04:02 GMT

The Cisco Endpoint Security aka Cisco Amp is worst AV product I have ever used. This thing's services keep stopping and definition update is stopped due to it. We cannot keep restarting computers servers.