Cisco Umbrella dnscryptproxy process stopps running

00urb57x9u0O6CPE25d6 — Thu, 23 Feb 2023 19:38:23 GMT

Hello,

We have updated to the latest Umbrella Roaming Client for Windows, but still many machines (~10%) show as 'Status = Unprotected' in the console.

It seems the dnscryptproxy.exe process crushes, which leaves the machine unprotected.

The parent service, ERCService.exe, still runs, but maybe lacks some watchdog type functionality (just restart the process).

Do we need to configure anything special in the Umbrella solution itself (running a separate scheduled task / client would be a workaround)? An enhancement in a new client version?

Thank you,

Re: Cisco Umbrella dnscryptproxy process stopps running

Mike Morrow — Wed, 26 Jul 2023 17:49:26 GMT

We have a similar issue with our Windows 10/11 endpoints so using our RMM system to restart the Umbrella_RC service daily. This helps for a while but some machines go back to the Unprotected state after a few hours or next day. Macs do not seem to be affected by this bug. We have an open ticket with Umbrella but they just want us to hassle users to run the diagnostic app. Seems there should be some way for us to do this diagnostics gather remotely without bothering the end user. Since we are seeing our endpoints frequently getting blocked for trying to access "Newly Seen Domains", having the endpoints not protected is kind of a big deal. We have been trying to find a common denominator with the machine going unprotected but have yet to find it.

topic Re: Cisco Umbrella dnscryptproxy process stopps running in Endpoint Security

Cisco Umbrella dnscryptproxy process stopps running

Re: Cisco Umbrella dnscryptproxy process stopps running