topic Re: Cisco AMP Endpoint not showing in console frequently in Endpoint Security

Cisco AMP Endpoint not showing in console frequently

JoshuaWisniewski44279 — Thu, 29 Oct 2020 19:00:42 GMT

Hey all,

I was wondering if I could get some assistance with an issue I'm encountering. I have a few servers setup that have the endpoint installed, but these servers frequently go missing when checking the console. Sometimes a restart helps, but I have no idea what is going on. Proper ports are open, and when they connect it works fine. It's disappearing at randoms times.

I'm wondering if it might have something to do with microsoft cluster services, or because these machines have two NICs installed?

The services on the PCs themselves are always running. I have also tried uninstalling and reinstalling the software.

Any help is appreciated!

Re: Cisco AMP Endpoint not showing in console frequently

Jbuttle — Fri, 30 Oct 2020 17:17:28 GMT

When you say "missing" are the endpoints actually being removed from the list or are they showing up as not having checked in for awhile?

Re: Cisco AMP Endpoint not showing in console frequently

JoshuaWisniewski44279 — Fri, 30 Oct 2020 17:49:46 GMT

They are completely missing.

Re: Cisco AMP Endpoint not showing in console frequently

Jbuttle — Fri, 30 Oct 2020 20:41:25 GMT

Cisco did just release a new connector version. Perhaps try updating that on the affected servers and see if anything improves, assuming you haven't done so. The latest is 7.3.5.20068.

It does seem odd that they would be removed from the list entirely.

Re: Cisco AMP Endpoint not showing in console frequently

ITandCoffee — Thu, 11 Nov 2021 19:53:25 GMT

We're seeing this issue as well in our environment. Any ideas? Active endpoints with the latest connector version are disappearing from the console entirely.

Thanks.

Re: Cisco AMP Endpoint not showing in console frequently

Scott Holden — Fri, 12 Nov 2021 19:31:31 GMT

I'm seeing this as well. A few random Windows endpoints have the latest connector (7.4.5.20701) but are missing from the console entirely. The service is running, the client shows as Connected, but isn't shown in the console. They were on 7.4.3 earlier this week, I have email alerts for these same machines when the Connector Update started and completed, and now they're gone.

Re: Cisco AMP Endpoint not showing in console frequently

ITandCoffee — Mon, 15 Nov 2021 18:25:05 GMT

Same thing I'm seeing in our environment - ever figure out a resolution by chance?

Thanks.

Re: Cisco AMP Endpoint not showing in console frequently

Scott Holden — Wed, 12 Jan 2022 18:38:00 GMT

I finally got around to opening a TAC case on this. It turned out to be duplicate UUIDs on the Windows 10 endpoints. I actually had several different duplicate UUIDs, so we apparently have laptop images that were captured incorrectly (after AMP services started and registered).

You can pull the UUID from this file on the endpoint:

C:\Program Files\Cisco\AMP\local.xml

You can then search for that UUID in your AMP/CSE console and see what machine is currently registered with it. The fix is to uninstall (select the option that says no future installations will be done on this device) and reinstall on the impacted machines. And fix the image.🙂

Re: Cisco AMP Endpoint not showing in console frequently

soup_dragon — Thu, 13 Jan 2022 08:32:57 GMT

Had a similar issue a few years ago when we started to deploy image with AMP installed on the image. Wasn't aware there was a switch when installing AMP on the image to stop it generating a GUID. That way when the image is deployed AMP installs with a new GUID each time.