Agent lost connectivity with the Core after long period of working without any issues (4041641)

Agent lost connectivity with the Core after long period of working without any issues

Agent machine became red (offline) without any apparent reason. Attempt to re-protect the agent may error out with credentials error ("credentials are invalid") or URL error. Machine name is correct and performing a web test with https://<machinename>:8006/apprecovery/api/agent/pair/connect correctly, providing an Agent ID XML

Too many Trusted Root CAs on the agent server. Possibly as a result of Windows Updates

Resolution:

To fix the issue please follow this Microsoft KB: https://support.microsoft.com/en-us/help/2801679/ssl-tls-communication-problems-after-you-install-kb-931125 then stop and start the Agent service on the protected machine

It's also possible to fix the issue manually by:
- open regedit
- navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
- backup the Certificates key to the file
- delete the Certificates key
- stop and start the Agent service

Protect the agent machine again, if necessary, from the Core console

The indication of that issue is SCHANNEL Event ID 36885 with the text: When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.