Agent Cannot be Protected by the Core Due to Environmental Issues (4033361)

Certain environmental settings may prevent Rapid Recovery from protecting an agent, resulting in connection, authentication, or SSL-related errors. Below are examples of common errors encountered during agent protection.

Common Errors

1. Connection Error (Before Metadata Is Taken)

   System.Net.Sockets.SocketException: An existing connection was forcibly closed by the remote host. Microsoft.Http.HttpStageProcessingException → System.Net.WebException → System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. System.IO.IOException: Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host.

2. Authentication Error

   WCFClientBase.ClientServerErrorException: Call to service method https://intranet:8006/apprecovery/api/agent/metadata/fullMetadata PUT failed System.Net.WebException: Authentication failed because the remote party has closed the transport stream.

3. Agent Pairing Failure (Log File Entry)

   ERROR - Service error while handling request [POST https://localhost:8006/apprecovery/api/core/agents/pairing/repairOrphan]: Error occurred pairing to agent at URL ‘https://spino:8006/apprecovery/api/agent/’;

These errors typically arise due to:

• Incorrect SSL settings
• Misconfigured HTTP driver or IIS settings
• Insufficient permissions on cryptographic keys
• Kernel-mode SSL settings in older Windows versions
• Certificate store overload prevents proper authentication
• NTLM authentication blocked by policy 

Windows Registry Disclaimer:

Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.

Follow the steps below to diagnose and resolve the issue.

Step 1: Identify Agent Service Errors

1. Navigate to the affected agent machine.
2. Stop the Rapid Recovery Agent Service.
3. Open a command prompt as an administrator and navigate to:

   C:\Program Files\AppRecovery\Agent
   

4. Run the following command:

   Agent.Service.exe /debug
   

5. Review the logs for errors. If the following error appears:

   System.Security.Cryptography.CryptographicException: The handle is invalid.
   

   then proceed to Step 2.

Step 2: Grant Correct Permissions

1. Navigate to:

   C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
   

2. Right-click the MachineKeys folder and grant Full Control permissions to:
   • The current user
   • The Local System account
3. Restart the Agent Service.

Step 3: Validate Agent Connection

1. Open a browser and access:

   https://127.0.0.1:8006/apprecovery/api/agent/pair/connect
   

2. If successful, you should see a GUID response:

   http://schemas.microsoft.com/2003/10/Serialization/“>ed2cd4ac-7960-4739-ae11-425fce678960
   

3. If the connection fails, continue to Step 4.

Step 4: Modify Agent Service Base Address

1. Stop the Agent Service.
2. Open Registry Editor and navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\AppRecovery\Agent\serviceHost
   

3. Change the ServiceBaseAddress key to:

   http://127.0.0.1:8006/apprecovery/api/
   

4. Restart the Agent Service.
5. Open a browser and test the connection again using:

   http://127.0.0.1:8006/apprecovery/api/agent/pair/connect
   

6. If the issue persists, proceed to Step 5.

Step 5: Check for SSL Kernel Mode Issues (Windows 2003)

If the agent runs on Windows Server 2003 SP1 or later, SSL may be running in kernel mode, causing client certificate issues.

1. Open Registry Editor and navigate to:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
   

2. Locate and delete the EnableKernelSSL parameter.
3. Reboot the server.
4. Attempt to protect the agent again.

Step 6: Verify Certificate Storage

1. Open Registry Editor and navigate to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
   

2. Locate the Certificates key.
3. Right-click and delete the key.
4. Restart the Rapid Recovery Core Service.
5. Attempt to protect the agent again.

Step 7: Verify NTLM Policies

One possible cause for this issue is NTLM authentication being blocked by domain or local security policy, which prevents the Core from pairing with the agent.

See KB 4378979 – Unable to Protect Rapid Recovery Agent Due to NTLM Restrictions Enforced by Local or Domain Policy for full details and resolution steps. 

Additional Notes

• If errors persist after completing all steps, check for non-default registry settings under:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP
  

• Ensure that SSL and HTTP driver settings are correctly configured.
• More details on certificate issues and cryptographic settings can be found in the next Microsoft article: SSL/TLS communication problems after you install KB 931125

Is your Rapid Recovery solution working as efficiently as possible? Learn more about our Rapid Recovery Health Check.