| Event Id | 21217 |
| Source | OnePoint Operations |
| Description | The Agent received no configuration from the Consolidator. This condition may occur if a new Agent starts up before the consolidator has updated its internal rules cache. It may also mean that the Consolidator no longer has any information about the agent, possibly because the Agent Manager has not been able to contact the agent for an extended period. |
| Event Information | The following information from a Microsoft article. Event 21217 Returned After Removing Agent from MCRs If you remove an agent computer from the Managed Computer rules and then commit the configuration changes, event 21217 might be generated for the uninstalled agent. This event is generated when an agent computer receives a configuration packet from the Consolidator that does not include configuration data. This happens if you manually exclude an agent from the MCRs and then you also commit configuration changes to processing rules before the uninstall delay period expires (48 hours by default).Because the computer is not included in the MCRs, the computer will not receive configuration data. However, because the computer is not yet uninstalled, it will still receive a configuration packet from the Consolidator. As a result, event 21217 is generated with every heartbeat. Use one of the following methods to solve this problem: a. Wait until the computer is uninstalled. After the uninstall delay period expires, approve the uninstallation. b.If the computer does not appear on the Pending Installation list, then use the following procedure: 1.Re-add the computer to the MCRs of a DCAM. 2.Run a managed computer scan. The DCAM will automatically recognize the agent and add the agent to its list of managed computers. 3.Use the Uninstall Now option to uninstall the agent immediately. This method bypasses the uninstall delay period and automatically adds an exclude MCR for the agent. If the agent is multihomed, then determine which configuration group removed the computer from its MCRs. Then, use the previous instructions to re-add and then remove the agent computer from the associated DCAM. If the agent was installed manually, then follow the instructions for uninstalling manually installed agents. See Uninstalling Manually Installed Agents earlier in this chapter. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.