AMP User Interface shows "Service stopped" when multiple users are logged in via Remote Desktop Services

[tfellinger]

Hi,

I have a FireAMP Connector installed on a server with Remote Desktop Services running.

When the first user logs in via RDP the tray agent looks good, green check mark, connected. But when the second user logs in the tray agent displays the error: "Status: Service stopped", but the service is running and the first user is still seeing a green check mark. So this looks like a communication problem between the tray agent and the service in case of multiple users logged in at the same time. I checked this in my lab and it behaves exactly the same.

Is there some special setting one would need to run AMP on a terminal server?

The only workaround I can think of is to disable the GUI, but that's not really a solution.

Thank you!

[yogdhanu]

Hi

When you are logged in to a windows machine with more than one user and the FireAMP user interface is enabled, you may see that some users see the UI as "Service Stopped" even though another account shows "Connected" and FireAMP functions correctly.

Only one(1) FireAMP user interface service (iptray.exe) can only connect to the main FireAMP service (sfc.exe) at a time. additional users that log on to a given windows workstation or server will cause an additional UI process to start, but it will appear as if FireAMP is stopped because of single pipe limitation to the sfc.exe service. 

It is important to note for users/customers that FireAMP is working properly, and this can be corrected by logging off the logged on user accounts and logging back in, or by killing all instances of iptray.exe from the task manager, and restarting it from the installation directory, or start menu shortcut.

So in the end its expected behavior with AMP

Rate if it helps.

[tfellinger]

Hello,

thank you for your explanation!

This is probably expected behavior, but in the end a real bad user expierence.

Do you know if there are any plans to make the tray-agent multi-user capable?

Thanks,

Thomas

[cmh-tyler]

Hello All,

Just found this post, which explains the issue I'm also facing. Would be great if the tray app could work for multiple users!

Thanks.

[Thomas Busch]

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc64688 is the current bug tracking this behavior. You may follow the bug to get updates to when the GUI will be able to support multiple user logins.

[cmh-tyler]

Thanks for the quick Reply Thomas, glad to know there is at least a bug created for the issue!

[viterra_au]

Hi Thomas,

Can you please explain how the workaround in the Bug Description is used to resolve the issue?  I cannot see anywhere here that prevents the "Service Stopped" message when multiple users log in.

Thank you,

Phil

[Troja007]

Hello @viterra_au,

the only thing you can do, if there are multiple users logging into one system at the same time, is to disable the tray icon using the AMP policy. As mentioned above, today the sfc.exe process can manage one tray icon connection.

You can talk to your Cisco representative to open a Feature Request for this. 

Greetings,

Thorsten

[Rameez007]

 The Cisco Endpoint Security aka Cisco Amp is worst AV product I have ever used. This thing's services keep stopping and definition update is stopped due to it. We cannot keep restarting computers servers.