Cisco Secure Endpoint service did not appear on my device?

[nguyen-loc]

[balaji.bandi]

what is the version cisco client installed and what OS is this windows 10, 11 or new one H2 ?

if this installed as service it should show there agent running.

[nguyen-loc]

Hello BB,

OS: Windows server 2022 version 21H2 (OS Build 20348.2700)

cisco client version 8.2.1.21612

After installing cisco client showed "Disabled" and I checked did not see in windows services.

[Roman Valenta]

Hi BB

Did you install the Secure Endpoint manually or was this pushed via MDM ? Any errors during installation ?

Also speaking of MDM is this device by any chance manage by Intune?

[nguyen-loc]

Hi Roman,

I installed the Secure Endpoint manually. No alert or error during installation.
This device was not managed by Intune.
Do you suggest where to get installation log for further check?

[Roman Valenta · Accepted solution]

Install log is usually generated under C:\ProgramData\Cisco\AMP\immpro_install.log you can take a look at that file for some clues.

Also if you navigate to C:\Program Files\Cisco\AMP\8.2.1.21612 can you find sfc.exe there? What happened if you try start the EXE manually?

I know you mentioned that this device is not managed by Intune but take a look at this TZ article bellow.

https://www.cisco.com/c/en/us/support/docs/security/secure-endpoint/222390-secure-endpoint-connector-updates-bein.html

 It was discovered that recent addition to Intune was causing very similar issue , in other words Secure Endpoint was installed but sfc.exe was blocked and never start. You will also see some examples of error messages in that article as well. Again might not be your problem but it will give you some idea what to look for.

[nguyen-loc]

Hi Roman
I excluded path "C:\Program Files\Cisco\AMP" in Window security
then Cisco client is working.

Thank you!