Troubleshooting a Forcepoint Endpoint Context Agent deployment

If you encounter issues during the Forcepoint ECA installation, review the following checklist, then try to install Forcepoint ECA again.

• Verify that you installed Forcepoint ECA using an account with local administrator rights. Forcepoint ECA installation requires local administrator rights.
• Check the connection between the endpoint machine and Forcepoint NGFW.
• Check the certificates installed in the endpoint machine’s certificate stores using mmc.exe and the Certificates snap-in. The certificate issuer (CA certificate) must be configured in the SMC. Verify that the policy on the NGFW Engine is up to date. The endpoint machine receives the network-side CA certificate in the Forcepoint ECA configuration file.

  The certificate generated by the SMC is valid from the time it was created in the SMC. If the time on the endpoint machine is different from the time in the SMC, the endpoint machine might not accept the generated certificate. After the endpoint machine’s time reaches the certificate's validity start time, the certificate is accepted on the endpoint machine.

The Forcepoint ECA client initiates connections to certificate revocation list (CRL) servers to verify the signatures of the executables that are initiating connections from the endpoint machine. When an executable connects to the network for the first time, the Forcepoint ECA client checks the executable’s signature against the CRL.

If the executable has been modified, or if the code signing certificate has been revoked, Forcepoint ECA does not trust the executable fields, such as product name, product version, or signer name, when it tries to match the executable in the Forcepoint NGFW. The executable’s signature check status is then logged in the SMC logs as “Failed”.