How to troubleshoot agent connection issues in ThreatLocker?

This document outlines the step-by-step process of how to troubleshoot agent connection issues in ThreatLocker Dashboard.

This article is a part of our ThreatLocker How-to Guides series, Chapter 11 – Maintenance and Troubleshooting.

Introduction

If a device is not communicating properly with the ThreatLocker Portal, you can follow these steps to identify and resolve connection issues.

Implementation

Step 1: Check the Agent Status in the ThreatLocker Portal

1. Log in to the ThreatLocker Portal.
2. Navigate to Devices > Computers.
3. Locate the target computer and verify that its status is Online, with the last check-in date and IP address displayed.

Step 2: Verify the HealthTL Service

1. On the target machine, navigate to : C:\Program Files\HealthTLService
2. The following options can be seen:

• logs folder – contains service log files
• HealthTLService.exe – executable to restart the service
• SkipInitialDelay.cfg – configuration file

3. Restart the HealthTL Service manually, double-click HealthTLService.exe.

4. A Command Prompt window will open, Wait until you see ‘Service status: Running’

Step 3: Check the ThreatLocker Service Logs

1. Navigate to: C:\Program Files\ThreatLocker\Logs
2. You will see daily log files in the format: log_YYYYMMDD.txt
3. Open the relevant log file to review any errors or warnings for troubleshooting.

Conclusion

By verifying the device status in the portal, restarting the HealthTL Service, and reviewing the ThreatLocker logs, you can quickly diagnose and resolve most agent connection issues.