Security Application not Running (Failed) , Real Time protection Stopped

[Abdulrahman Sabri]

I found this issue with one of my managed device in administrator Server , When  I am trying to run security application it give me Failed message 

[Tahmeed702]

On 2/20/2025 at 1:14 PM, Abdulrahman Sabri said:

I found this issue with one of my managed device in administrator Server , When  I am trying to run security application it give me Failed message 

Check Ping Connectivity and Device accessibility from KSC , and make sure that client/user didn't forcly exit the keswin app , set password policy on keswin so that user can't turn it off , do check netagent is functioning properly on that workstations

[Danijel Jovanovic JAPICOM]

That option works only if endpoint is reachable FROM KSC Server. If managed endpoint is in LAN and KSC can reach it, you can start or stop application from there. If, for example, endpoint is reaching KSC from internet, you can not start or stop applications from there. 

You can create a task to start or stop application in that case and after next sync app will be started or stoped.

[Renan Corassa]

It is very likely that you have problems in the application, since the Network Agent is running and KES is not, this indicates a problem in the application. Perform a complete removal and reinstall and see if the status returns to normal.

Edited February 24 by Renan Corassa

[Danijel Jovanovic JAPICOM]

2 minutes ago, Renan Corassa said:

It is very likely that you have problems in the application, since the Network Agent is running and KES is not, this indicates a problem in the application. Perform a complete removal and reinstall and see if the status returns to normal.

It doesn't need to be a problem with app. If its just problem with starting an application from KSC as it is on screenshot, as i said, you can not start application if endpoint is not reachable from KSC.

KSC needs to be reachable from endpoint to be visible in KSC managed devices, but endpoint doesn't need to be reachable from KSC to be managed. 
If KSC can reach endpoint, you can start or stop application like in screenshot.
If KSC can not reach endpoint, you can not start or stop application like in screenshot.

[Renan Corassa]

KES was designed to start when the OS boots. If there was a failure in a possible update or something like that, the program may have been corrupted and prevented from starting, unlike the Network Agent. If there is a good policy in place, KES cannot be closed by any user to have this status. I agree with you on everything that was mentioned regarding the access issue, but if the Network Agent can inform KES with this status, then we have normal network-level access. However, the KES application may have a problem that prevents the Network Agent from accessing the necessary information and giving the KSC a Running status.