04-13-2016 12:04 PM - edited 02-20-2020 09:29 PM
Hi,
I have a FireAMP Connector installed on a server with Remote Desktop Services running.
When the first user logs in via RDP the tray agent looks good, green check mark, connected. But when the second user logs in the tray agent displays the error: "Status: Service stopped", but the service is running and the first user is still seeing a green check mark. So this looks like a communication problem between the tray agent and the service in case of multiple users logged in at the same time. I checked this in my lab and it behaves exactly the same.
Is there some special setting one would need to run AMP on a terminal server?
The only workaround I can think of is to disable the GUI, but that's not really a solution.
Thank you!
05-06-2016 11:01 PM
Hi
When you are logged in to a windows machine with more than one user and the FireAMP user interface is enabled, you may see that some users see the UI as "Service Stopped" even though another account shows "Connected" and FireAMP functions correctly.
Only one(1) FireAMP user interface service (iptray.exe) can only connect to the main FireAMP service (sfc.exe) at a time. additional users that log on to a given windows workstation or server will cause an additional UI process to start, but it will appear as if FireAMP is stopped because of single pipe limitation to the sfc.exe service.
It is important to note for users/customers that FireAMP is working properly, and this can be corrected by logging off the logged on user accounts and logging back in, or by killing all instances of iptray.exe from the task manager, and restarting it from the installation directory, or start menu shortcut.
So in the end its expected behavior with AMP
Rate if it helps.
05-08-2016 01:27 PM
Hello,
thank you for your explanation!
This is probably expected behavior, but in the end a real bad user expierence.
Do you know if there are any plans to make the tray-agent multi-user capable?
Thanks,
Thomas
09-11-2018 03:25 PM
Hello All,
Just found this post, which explains the issue I'm also facing. Would be great if the tray app could work for multiple users!
Thanks.
09-11-2018 04:09 PM
09-11-2018 04:13 PM
Thanks for the quick Reply Thomas, glad to know there is at least a bug created for the issue!
12-05-2019 04:56 PM
Hi Thomas,
Can you please explain how the workaround in the Bug Description is used to resolve the issue? I cannot see anywhere here that prevents the "Service Stopped" message when multiple users log in.
Thank you,
Phil
12-06-2019 12:31 AM
Hello @viterra_au,
the only thing you can do, if there are multiple users logging into one system at the same time, is to disable the tray icon using the AMP policy. As mentioned above, today the sfc.exe process can manage one tray icon connection.
You can talk to your Cisco representative to open a Feature Request for this.
Greetings,
Thorsten
12-16-2021 07:04 AM
The Cisco Endpoint Security aka Cisco Amp is worst AV product I have ever used. This thing's services keep stopping and definition update is stopped due to it. We cannot keep restarting computers servers.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide