A common issue we see in relation to Huntress Agent communication is conflicts in the Defender Firewall profile status. This has been known to affect communications to the Huntress Portal, but it's relatively easy to troubleshoot as long as you know what you are looking for.
If the endpoint is Domain-joined and is actively updating Group Policies, it needs to have connectivity to the Domain Controller in order to pick up any new policies to update. If you are having issues with connection to the Domain Controller, skip to Ensuring the Device is Connected to the Domain.
Firewall Status in the Agent Overview
In the Huntress portal under the agent overview page, there is now a new section which details the current Firewall Status.
There is an example of this below, which shows us a couple of things:
- The Firewall is enabled
- The active profile is set to the Domain Profile
-
The status is showing as "Enabled (Conflict)", under the Firewall Values column, you can see that the local policy is set to enable the Domain Profile, whereas the group policy is set to disable the profile.
In this instance, the Domain Profile is currently active on this endpoint, but a Group Policy Object is set to disable the Domain Profile. The most likely scenario we would see from this is that a reboot of this endpoint may change the profile to one of the other enabled ones, such as public. Public profiles in particular are known to restrict agent communication, so this is something we would suggest to disable.Useful PowerShell Commands
To check the current status of the firewall on the endpoint, we'd suggest using PowerShell, and have included some useful commands below:
-
See the current active profiles: Get-NetConnectionProfile
Using this command, you will see the Network Category Profile which has been set for each network interface device, if you are using a VM with multiple NICs this is something worth noting, as one may differ from the other.
-
Set the active profile: Set-NetConnectionProfile -NetworkCategory <profile type i.e private/domain/public>
If you are using multiple NICs on one endpoint, you will need to specify which interface you are changing, there is some more information on the syntax of this command here.
If you wanted to change the Network Category Profile to domain manually, you would use the following:
Another example which you can see below, the firewall is in a different state:
- The Firewall is disabled
- The active profile is the Domain Profile
-
All 3 profiles (Domain, Private and Public) are set to disabled locally on the endpoint. There is no group policy affecting this endpoint.
For this example, we would suggest enabling the profile of the desired network category (usually domain if this is a domain-joined endpoint), otherwise this can default to another profile status after reboot.
The profile which you want to use should be enabled, and the rest should be disabled as a general rule.
Group Policies
Group policies are a great way to ensure that your fleet of endpoints are uniform in their Firewall settings, sometimes we can see conflicts from the local and group policies which can affect the network profile, thus affecting agent communication.
When troubleshooting conflicting group policies with one of our Product Support Specialists, we are able to provide the ID of the policy in question, this will help you to narrow down which GPO you are looking for.
Here's an example of what we can provide below:
"id": "{<id>}",
"precedence": 1,
"name": "EnableFirewall",
"gpoid": "CN={<id>},CN=Policies,CN=System,DC=<domain>=LOCAL",
"somid": "DC=<domain>,DC=LOCAL",
"deleted": false,
"registry_key": "Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile",
"value_name": "EnableFirewall",
"value_type": 4,
"value": "AAAAAA=="
In this case, the endpoint may state that the active profile is set to the Domain Profile currently, however it also shows the value of the GPO for the Domain profile as "AAAAAA==" (disabled) where it should be "AQAAAA==" (enabled). This means after a reboot of the endpoint, the Domain Profile can be disabled and it can default to another profile.
Ensuring the device is connected to the domain
It is important when troubleshooting the firewall policies that the endpoint is actively communicating with the Domain Controller (if it is a domain-joined device).
Some things to check for if you are not sure.
-
Are you able to ping the IP or hostname of the DC from the endpoint?
- If not, check the network connection and ensure the device is on the correct network.
- Is the endpoint remote? If so, are you able to establish a VPN connection to re-establish the connection to the domain?
Ensuring your endpoints are talking with the domain can help solve a lot of issues around GPOs and Huntress agent management