[SOLVED] Windows VM displayed as disconnected

[Dr. Mathieu]

Hello everyone,

this is my first post on this forum, and despite searching everywhere, I can't find a solution.

We have a Windows VM that appears in our WAPT console, but it's showing as disconnected, which isn't the case because I can access it via RDP and perform actions on it.
I've tried several things with the WAPT agent: reinstalling, stopping and starting the service, checking the configurations and logs. It pings the server, and the same with nslookup, etc., but I still don't understand why it's disconnected.

Another interesting point: when I run "runwaptservice" from the command prompt (CMD), it's connected, and I can perform actions on it. Of course, when I close the command prompt, it disappears again.

Thank you for your help.

[dcardon]

Hello Mathieu,

Could you run runwaptservice.bat as LOCALSYSTEM to see if it works or not? (The WAPT service runs in the LOCALSYSTEM context).

To do this, you can use the psexec.exe command line from Microsoft Sysinternals (if your EDR doesn't block it). It's available in the tis-sysinternals-pstools package. To launch a command prompt as LOCALSYSTEM, you can use the following command:

Code: Select all

psexec.exe -i -s cmd.exe

Then, in this cmd.exe window, launch runwaptservice.bat

Sincerely,

Denis

[Dr. Mathieu]

Hello Denis,

I was able to reconnect the VM using the runwaptservice.bat command while I downloaded and installed the tis-sysinternals-pstools package.

When I rerun the command in LOCALSYSTEM, I get an error message that I don't understand:

Code: Select all

Le service WAPTService n’est pas lancé.

Vous obtiendrez une aide supplémentaire en entrant NET HELPMSG 3521.

Traceback (most recent call last):
  File "<string>", line 23, in <module>
  File "C:\Program Files (x86)\wapt\waptservice\waptservice_common.py", line 44, in <module>
    import common
  File "C:\Program Files (x86)\wapt\common.py", line 26, in <module>
    import setuphelpers
  File "C:\Program Files (x86)\wapt\setuphelpers.py", line 157, in <module>
    from setuphelpers_windows import get_file_properties,get_domain_fromregistry
  File "C:\Program Files (x86)\wapt\setuphelpers_windows.py", line 42, in <module>
    import win32com.client
  File "C:\Program Files (x86)\wapt\lib\site-packages\win32com\client\__init__.py", line 11, in <module>
    from . import gencache
  File "C:\Program Files (x86)\wapt\lib\site-packages\win32com\client\gencache.py", line 655, in <module>
    __init__()
  File "C:\Program Files (x86)\wapt\lib\site-packages\win32com\client\gencache.py", line 57, in __init__
    _LoadDicts()
  File "C:\Program Files (x86)\wapt\lib\site-packages\win32com\client\gencache.py", line 110, in _LoadDicts
    version = p.load()
_pickle.UnpicklingError: invalid load key, '\x00'.
Exception at 01053067: EPyException:
UnpicklingError: invalid load key, '\x00'.

Thank you for the manipulation
Good day
Mathieu

[dcardon]

Hi Mathieu,

it seems to be a bug with the win32com Python library. This library creates a Python stub on the fly to call Windows Win32 APIs, the gen_py cache, but it appears to be corrupted in your case.

You can try deleting the C:\Windows\Temp\gen_py\3.9 directory and then restarting the agent from the command line as a SYSTEM account. This will help determine if the problem with creating the gen_py stubs was transient or if it's a different issue.

It works as an admin user because gen_py is created in the user's %temp% directory, which differs depending on whether you're logged in as LOCALSYSTEM or an administrator.

This is a recurring problem. We haven't yet found the sequence that triggers this issue... But we could clear the gen_py cache and perform a regeneration if the load fails.

Best regards,

Denis

[Dr. Mathieu]

I did delete the folder; in my case, it was C:\Windows\Temp\gen_py\3.8.
Stopping the runwaptservice puts the machine in "Disconnected" mode, but I had to restart the WAPT service for it to work.

I rebooted the VM, and it seems to be working now. Thank you very much for your feedback.

Have a good day,
Mathieu

[dcardon]

Hi Mathieu,

thanks for the feedback. We'll see how to better handle crashed gen_py. I'm marking the topic as RESOLVED.

Regards,

Denis