Anyone knows the name of the file responsible for the crash (corrupted update file) ?

Your could change the resolution script like this:       # remediation:        $sfc = @(Get-ChildItem -Path "$env:ProgramFiles\Cisco\AMP" -Recurse -Include "sfc.exe")    $sfc | foreach { .$($_.fullname) -k <YOUR PASSWORD> }        $svc = Get-Service ...

FINAL VERSION FOR SCCM THAT APPLY TO 32-bit only ___________________________ TO APPLY ON ALL : just remove -and ( (Get-WmiObject Win32_OperatingSystem).OSArchitecture -eq "32-bit" ) ___________________________ # compliance check:$ampLog = @(Get-WinE...

Correction: 7031 $ampLog = @(Get-WinEvent -FilterHashtable @{logname='system';id=7031;startTime=$((Get-Date).AddHours(-1)) } | Where-Object { $_.message -match "Cisco AMP"})

Event ID 7031 that matches cisco AMP   $ampLog = @(Get-WinEvent -FilterHashtable @{logname='system';id=7003;startTime=$((Get-Date).AddHours(-1)) } | Where-Object { $_.message -match "Cisco AMP"}) if ($ampLog.Count -gt 0) {    $svc = Get-Service | Whe...