Kaseya Community

KRC \ Connect then Disconnect

This question is answered

We just upgraded to 7.0 (Patch 19) this past weekend. Using KRC we've been hit with a few agents who are unable to connect. 

Troubleshooting we go to the agent log directory: C:\ProgramData\Kaseya\Log\KaseyaAgent\Instance_**************\Session_BFA22524-AA90-4FE7-9A57-74D6D8567017\KaseyaRemoteControlHost

Error in KRC logs ...

KaseyaRemoteControlHost Started
[I2014-08-25T13:46:12.360207-04:00 c98] Command Line: --ip 127.0.0.1 --port 27190 --session BFA22524-AA90-4FE7-9A57-74D6D8567017 --agentInstance **************
[I2014-08-25T13:46:12.578610-04:00 1870] [IOThread] Started
[I2014-08-25T13:46:12.594210-04:00 1870] User Process Created on try number: 1
[I2014-08-25T13:46:12.594210-04:00 1278] [UserSessionListenerThread] Started
[I2014-08-25T13:46:12.625410-04:00 1278] Desktop Name:Default sessionId:1
[I2014-08-25T13:46:13.608223-04:00 394] [VideoEncodeThread] Started
[I2014-08-25T13:46:36.010110-04:00 1278] User Session Changed - notifying server
[I2014-08-25T13:46:36.010110-04:00 1278] [UserSessionListenerThread] Stopped
[I2014-08-25T13:46:36.010110-04:00 394] [VideoEncodeThread] Stopped
[E2014-08-25T13:46:36.119312-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:36.680919-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:37.195725-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:37.710532-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:38.225339-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:38.740145-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:39.254952-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:39.769758-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[E2014-08-25T13:46:39.769758-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe

Access is denied (system:5)
[E2014-08-25T13:46:40.284565-04:00 1870] [Process] Failed to launch C:\Program Files (x86)\Kaseya\Agent\KaseyaRemoteControlHost.exe
Access is denied (system:5)
[I2014-08-25T13:46:40.799372-04:00 8d4] [UserSessionListenerThread] Started
[I2014-08-25T13:46:40.799372-04:00 8d4] Desktop Name:Default sessionId:4294967295
[I2014-08-25T13:46:43.903811-04:00 8d4] User Session Changed - notifying server
[I2014-08-25T13:46:43.903811-04:00 1870] User Process Created on try number: 1
[E2014-08-25T13:46:43.903811-04:00 1870] IPC to user process did not complete
The pipe has been ended (system:109)
[I2014-08-25T13:46:43.903811-04:00 1870] ServiceController: Shutdown invoked
[I2014-08-25T13:46:43.903811-04:00 8d4] [UserSessionListenerThread] Stopped
[E2014-08-25T13:46:43.903811-04:00 1870] Error from network
The network connection was aborted by the local system (system:1236)
[I2014-08-25T13:46:43.903811-04:00 1870] ServiceController: Shutdown invoked
[E2014-08-25T13:46:43.903811-04:00 1870] IPC to user process did not complete
The pipe has been ended (system:109)
[I2014-08-25T13:46:43.903811-04:00 1870] ServiceController: Shutdown invoked
[I2014-08-25T13:46:43.903811-04:00 1870] [IOThread] Stopped
[I2014-08-25T13:46:43.903811-04:00 c98] === RemoteControlHost Finished ===
[I2014-08-25T13:46:43.903811-04:00 bfc] [UserSessionListenerThread] Started
[I2014-08-25T13:46:43.903811-04:00 bfc] Desktop Name:Default sessionId:2

Anyone have any ideas on this? The  box is a Windows Server 2008 SP2 Standard virtual machine.

Thanks!

Verified Answer
  • Well slap my ass and call me sally. Restarted the agent again and the connection worked.

    Smh

All Replies
  • Access denied (error 5) is typically a permissions error. Do you have nonstandard permissions set on the kaseya program files folder? have you specified agent credentials?

  • Or perhaps an antivirus or firewall blocking the KaseyaRemoteControlHost.exe process?

  • We're also at 7.0 patch 19 and see some servers not connecting with the new KRC tool.

    Just today I'm starting to gather evidende to post in a ticket.

    You have a lot of access denied errors in the logging, that's the first thing to look at.

    The initial connect will be done with the account the Kaseya agent service is using to run.

    We usually use a domain service account that has sufficient rights in the OS and to run commands.

    In practice we used a RS.Kaseya account that was domain admin, but for security reasons we've decided not to do that anymore. You could try to give the Kaseya Service account full rights and restart the service to test it.

    Furthermore there's a post about troubleshooting KRC at the following link:

    helpdesk.kaseya.com/.../66203308-Troubleshooting-Kaseya-Remote-Control

    That should give you enough to find out what's going on.

    Good luck, Eric.

  • @ Craig - Normal permissions on the Kaseya folder. We don't use agent credentials.

    @ Zippo - We use Kaseya AVG (Managed Endpoint Security) for AV on the VM. We have this deployed to over 7,000 endpoints and have not hit the issue so I don't think it's that. Local Windows firewall is disabled.

  • @ OudjesEric - Thanks for the information. The Kaseya agent service is using the Local System. This is the same for every other agent we have deployed. I read through the article and the only thing I found valuable was the noted location of the logs and the ultimate 'send the logs to support'. I'm surprised there is not more information available as to troubleshooting etc....

  • Well slap my ass and call me sally. Restarted the agent again and the connection worked.

    Smh

  • That's a known option, I just restarted an agent to get KRC back.

    In this case I could use the mouse in the KRC session, but keyboard did nothing.

    An easy fix...

  • Simple restart of the agent does work. Here is a agent procedure to restart the agent to make life easier also. 

    <?xml version="1.0" encoding="utf-8"?>
    <ScriptExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
    <Procedure name="Restart.Agent" treePres="3" id="2078531727" folderId="82414262189816722233238121" treeFullPath="AIMS.Team">
    <Body description="">
    <Statement name="GetVariable" continueOnFail="false">
    <Parameter xsi:type="EnumParameter" name="VariableType" value="AgentTempDirectory" />
    <Parameter xsi:type="StringParameter" name="SourceContent" value="" />
    <Parameter xsi:type="StringParameter" name="VariableName" value="agTemp" />
    </Statement>
    <Statement name="WriteFile" continueOnFail="false">
    <Parameter xsi:type="StringParameter" name="Path" value="#agTemp#\restart.cmd" />
    <Parameter xsi:type="StringParameter" name="ManagedFile" value="john.nuttall\restart.cmd" />
    <Parameter xsi:type="BooleanParameter" name="DeleteAfter" value="False" />
    </Statement>
    <Statement name="ExecuteShellCommand" continueOnFail="true">
    <Parameter xsi:type="StringParameter" name="Command" value="#agTemp#\restart.cmd" />
    <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
    <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
    </Statement>
    </Body>
    </Procedure>
    </ScriptExport>

  • ... Couple of comments for you on your script Glen...

    1. You'll need to give the contents of the restart.cmd file or it will do no one any good.  I can *probably* guess at it's contents, but it's always better to include the contents so no one has to guess.
    2. ON this one I'm really just being picky because it's a pet peeve of mine with even some of the scripts that Kaseya includes as samples... The "Get Variable" step is not really necessary at all.  There is already a "Built in" variable that contains the Agent Temp Directory in the way of the built in views.  using #vAgentConfiguration.agentTempDir# will save you one step.. 

    Like I say on #2, I know that's just me being picky, but it's just been ingrained into me to try and make any script as efficient as possible.