Windows Agent Troubleshooting
Update the Agent
Before performing any troubleshooting steps, please be sure you have the latest version of the Agent.
How to check if you have the latest version of the Agent:
Navigate to the UI
Then go to Settings>Protect Agent
From the “Install” screen, you’ll see the “Install Download” buttons. These buttons have the latest release number on them. Note the release number for the Windows Agent here.
Now, there are two quick ways to find out which version is on your machine.
Navigate to the “Manage Agents” section of the HPA Dashboard.
From there, find your machine name, and scroll over to see it’s associated version.
Navigate back to your Windows machine.
Right-click on the HYAS Protect icon in the Notification Tray and you’ll see the version number at the bottom of the window.
If your Agent version is outdated, please follow the Uninstall directions listed above and install the latest version.
Debug Mode
In all cases where it is suspected that the HYAS agent may be encountering an issue or may be the cause of connectivity issues it is highly recommended to enable debug logging for the HPA to capture verbose telemetry to expedite troubleshooting.
To enable Debug mode, refer to the Agent Preferences section above.
From there, Client Admins or HYAS can review the logs located at “C:\protect\logs\dnsproxy.log”
Captive Portal Connectivity
Issue
When connecting to the Internet via a hotel, coffee shop, or related location, often the store or location utilizes a “captive portal” that the device must connect to prior to obtaining full Internet access. In some cases, the device may not properly connect to the captive portal, meaning that the device may not properly authenticate to obtain access to the Internet.
Solution
First – the user should perform a restart of their device. A device reboot should resolve the issue; if it does not, please perform the steps below.
If a reboot does not resolve the issue, and the device still cannot connect to the captive portal, you need to stop the Protect service (please note the user will need admin privileges to perform these steps)
To stop the HPA, follow one of the above recommended methods and stop the service via the UI or PowerShell.
The device should now be able to connect to the captive portal and thus the Internet. If the captive portal does not appear, consider disconnecting from the network and reconnect to prompt the captive portal to appear, or reboot the machine.
When network access has been restored, restart the Protect service using one of standard procedures referenced above.
If the above suggestions are ineffective and immediate access to the network is required, the agent may be disabled via the following procedure:
Connect temporarily to another network such as personal cellular hotspot
Coordinate with IT to allow an admin to remotely access the machine
Admin runs a disable script provided by HYAS
When the agent has been disabled, disconnect from the hotspot or other network
Reconnect to the network with the captive portal (may require machine reboot)
Local Domains Not Resolving
Issue
Unable to connect to local domains.
Solution
Corporate networks, often referred to as a corporate or company Intranet, typically use local domains (DNS suffixes) for local resources. If a problem with the resolution of local domains occurs:
Ensure all local domains associated with the organization are configured in the Local Domains tab in the HYAS Protect UI.
This can be found under Settings > Protect Agent
If a local domain is not configured, then endpoints will not be able to resolve resources associated with that domain.
Configure any internal resolver IP in the HYAS Protect UI that is expecting an endpoint to query for DNS records. This should be completed prior to the agent installation to prevent possible resolution issues and negative user experience.
Split-Brain/DNS/Horizon Functionality
Issue
In some cases, organizations use of the same domain both on the local intranet and on the internet. This dual usage creates ambiguity in resolving the domain's IP address, as it may resolve to private IP addresses when connected to the intranet and to public IP addresses when outside the office.
Solution
In determining network location, the HYAS Protect Agent distinguishes between local and external networks. If it detects the local network, it routes DNS requests to local resolvers based on defined settings. Otherwise, it directs queries to HYAS Protect cloud resolvers. The HYAS Protect web portal facilitates configuring specific DNS queries and their expected outcomes. The agent then periodically runs these tests to differentiate internal from external requests. Note that versions of the agent before 2.2.1 lack Split Brain DNS functionality and may not function properly in such scenarios. Upgrade to version 2.2.1 or above for optimal performance. Find the latest agent version in the UI under Settings > Protect Agent > Install. Click here to learn more about configuring Split-Brain DNS
Unable to Connect to the Internet
Issue
Unable to connect to known network after installing the HPA.
Solution
There can be a number of reasons why a device cannot connect to the internet. First, check your local machine settings to ensure your Wi-Fi is turned on. If you’re using an Ethernet cable, verify that it is securely connected to both your computer and the router. Verify all hardware is turned on and working properly.
Restart the machine. Most issues can be resolved by restarting the machine running the HPA.
If you’ve completed all standard diagnostic procedures and still suspect an issue with the HPA, please request the Protect Agent Advanced Debugging Guide from your HYAS representative for further troubleshooting.
Also, if you need immediate access to the internet, disable the HPA via the web UI.
Unable to Connect to the Internet After Uninstalling the HPA
Issue
Unable to connect to to the Internet after uninstalling the HPA
Solution
In some cases on Windows machines running older versions of the HPA, the uninstallation process fails to revert known networks to their DHCP settings, rendering connections to said networks impossible. A “known network” refers to a network previously connected to by the machine while the agent was active. “Forgetting” the network does not rectify this issue.
Workaround
The end user will need to connect to a new network the agent has not encountered. This will enable an IT administrator to remote in and reset DHCP for the network.
To avoid this problem, disable the HYAS Protect service. The following command can be used to identify if the network reset was successful ‘ipconfig /all | findstr DNS’. If the DNS settings show “::1” or “127.0.0.1” then it was not successful. If the network has not been successfully reset, re-enabling the service is necessary. It’s important to note that uninstalling the agent might leave the user without network connectivity.
Missing Devices in Logs or Protect Agent>Manage Tab
Issue
You’ve installed the Agent via a golden image and some of the machines are “missing” from the logs or from the Protect Agent>Manage tab.
Solution
If the golden image is not configured correctly, it may duplicate the machine ID across all devices where it's deployed. This causes log discrepancies, making it seem like machines are missing, as multiple devices share the same ID. It can also result in machines briefly appearing in the Manage tab before disappearing. To prevent this, ensure the golden image is set up to generate unique machine IDs on each device.
Additional Troubleshooting Scripts for PowerShell
Note that Administrator privileges are needed in order to run the below scripts.
View Local Log
Get-Content -Path "C:\protect\logs\dnsproxy.log" -WaitUninstall
Uninstall-package -Name "HYAS Protect"Check running state
Get-Process | Where-Object { $_.Path -like "*dnsproxy*" }
Get-Service | Where-Object { $_.Name -like "*hyas*" }
Get-Process | Where-Object { $_.Path -like "*hyas protect.exe*" }Stop Service
Stop-Service "HYAS Protect"Start Service
Start-Service "HYAS Protect"