Carl Seiler

Will do. Looks like that was successful at removing the warning. Marcos, what I see might have triggered this is there was an update on the server that failed due to full C drive (log files had not been purged). When the hard drive was freed up, the update occurred, but it looks like it may think there are two installs. Does that make sense as possibility?

ESET Protect here, with ERA console stating: Muliple connections with identical agent id. I click on the link and the only thing I can find is: But that article seems to have something to do with cloning in VMs, and my setup has no VMs, and all machines have been running for months. I recently upgraded minor versions on some endpoints from 11.0.20320 to 11.0.2044.00, so I don't know if this popped up after that. How do I identify which "agent" or "connection" is the problem?

Marcos, any other ideas? Is totally removing the client app locally and reinstalling a safe bet at this point? Carl

I'm not sure what you mean by a filter enabled. I can see that the Management Agent is installed, but cannot see the Endpoint client installed. Is there a filter somewhere that shows only the Management Agent and not the Endpoint agents? This is the only endpoint device that has this filter applied, I'm guessing. How do I clear the filter? Where is the filter on that screen? I see the filter-by thing now, and there is nothing filtered that is obvious to me. See screenshot [Edit: Making sure that you understand that the issue is not that the device does not show. It does show under Computers. The issue is that in the list of Installed Applications Endpoint protection does not show.]

Marcos, I sent log via DM. Please advise if I should send via other means.

Marcos, I should also point out that this machine had a previous version of 10.x of Endpoint installed. But I removed it using ERA and unregistered it as that seat was needed to stay below our licensing numbers. Since we had a number of turnovers, I found that we had an extra license, and I was attempting to reinstall from ERA since the device still had the management software installed, just in case we filled that position the machine would be ready for the new coworker. So, there's possibly something about the old install that it doesn't like. Just a guess. I didn't mention it earlier because I didn't remember until I started to wonder what was different on this machine.

Just to be clear. I did not manually install it. It successfully installed from the ERA (at least that is what I told it to do). The ERA panel says the task failed. When I go to the computer it appears to be installed and working, and the ERA panel does not show it as installed.

I looked at the status.html on the local client machine. Everything looks good. Carl

Attempted to install local client on machine running Windows Pro 10 22H2. ERA repeatedly reports that the install has failed. See first attachment. It also doesn't show in installed apps in ERA, only the management tool does. See second attachment. I went to the local machine to try and install it manually, and lo and behold, the client is installed, and up and running as instructed. The question I have now is how to make ERA recognize that the install was successful and that the application can be managed from ERA? Thanks, Carl

OK, they suggested I toggle the AMSI setting off and back on on the endpoint device. I wasn't able to do that, so they instructed me how to set the override mode on ERA. I tried that, but was unable to get override mode to work. Every time I clicked on the button, I would be told “Not authorized: The user account is not authorized to override policy settings. Log in as a different user or contact the administrator.” I rebooted twice (even though I had rebooted many times before, and something about logging in as a local administrator on that machine seemed to wake up the AMSI even though I never got the Override policy to work and thus never got a chance to toggle the AMSI setting of and back on in the ESET GUI. In the end, the tldr solution seemed to be to log in as local admin and reboot several times and log back in as local admin. I realize this may not work for everyone, so the best bet is to follow Marcos' instructions and open a ticket, but if someone else runs into this issue, it is a rather non-destructive way to see if it works for you.

Thanks again, Marcos, for your prompt response. I have opened a ticket. I will wait for them to request logs and tell me the next steps. Otherwise, if they make a suggestion that works, I will report back here what worked for us. Cheers

After recently upgrading to 11.0.2032.0, one endpoint device on Windows 10 Pro 22h2 is reporting the message above in the ERA. This is similar to the thread here: Have repeatedly rebooted, including using shutdown -r -t 0 This is the only device with the issue currently.

Thanks. I was a little afraid to do that, because I didn't want it to remove both of them since they have the same name. I have now done so and everything looks good now. Thanks again for your response.

@Marcos, see how I now have two of the same computer. The old one is the one I accidentally removed from management, still showing up as red. The other one with the same name is now showing back up as I have re-deployed the management software. How do I remove the duplicate?

Re-deploying the management agent made it show up in the list of computers again. Now I have two computers showing with the same ID in the "Computer Name" column. How do I get rid of the extra one?