Troubleshooting Avecto Defendpoint service stops randomly

Question

I am getting several users complaining about their Avecto Defendpoint Service just stopping all of a sudden. May I ask what is the best way to troubleshoot and find out what is causing the service to stop?

I ran a PGCaptureConfig extract and looking at the Avecto IC3 client log, I can see the warning about the “Defendpoint agent service is not running”. I have looked at the Windows event log but it does not really say anything what might have caused the service to stop.

Jens Hansen · Answer

The Avecto Defendpoint Service should not stop!

3 reasons for it to stop.

The service Crashes and fails to start again.
Conflicting Application that prevents it from running.
A user stopped the service with a privileged account.

The third option can be resolved using the Agent Protection.

Second is to add exclusions within other 3rd party Security Clients installed.
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0017099

The first will need some investigation and a ticket with BeyondTrust to get resolved.
https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017077

If the Avecto Defendpoint Service is crashing there is usually some debug files residing on the system and need to be collected. but do your self a favor for raising the ticket collect as much possible data to include in the ticket while also a PGCaptureConfig from a system that has the issue.

There can be a need for enabling crash dumps.
https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sysparm_article=KB0017096

I suggest trying out step 2 and 3 first.

Kind regards
Jens