Skip to main content

Huntress Platform - Troubleshooting Stuck Remediations and Host Isolation Releases

Jackson
  • Updated

Team: Huntress Managed Endpoint Detection and Response (EDR)

Product: Huntress Platform

Environment: Cross-platform (Windows, macOS)

Summary: Learn how to troubleshoot pending or stuck remediation actions and host isolation release tasks directly from an active incident report.

 

If the remediations, host isolation or release of isolation is stuck, follow the steps below to troubleshoot and determine the cause.

 

 

Steps to ensure the endpoint is powered on and responding to the Huntress Dashboard.

  1. Make sure that any 3rd party software, AV, etc is not causing interference issues with the Huntress Agent being able to communicate, as this often leads to isolation or remediation commands being stuck or failing to complete.

    We highly recommend double checking your 3rd party security tools allow/exclusion list as Host Isolation can cause AV/EDR false positives even if all other machines are operating as expecting without the allow/exclusion list.

    Relevant Links: AV Allow list KB

  2. From the upper left data fields in the incident report, select the affected endpoint name under "Entity" to open the Endpoint Details page in the Huntress dashboard.

  1. Review the Last Seen timestamp to confirm that the endpoint is powered on and connected to the internet. If the endpoint is powered off or falls into sleep mode, this will result in the endpoint disconnecting from the internet and failing to resolve traffic from the Huntress agent back to our dashboard to update the remediations and or release of isolation. This will increase the Last Seen time and indicate the Agent is not able to resolve traffic back to our dashboard to update its status.

 

Further investigation steps to check the items below are not causing Agent unresponsiveness.

  • DNS Resolution: Ensure the endpoint can resolve hostnames. When isolated, the Huntress Agent falls back to public DNS (1.1.1.1:53/udp). If outbound UDP traffic on port 53 is blocked by network rules, isolation status can't be verified and may be displayed as Pending in the dashboard when it may actually be isolated.

    Relevant Links: 

  • Third-Party Security Software: Verify that secondary endpoint protection tools or third-party firewalls are not blocking the Huntress Agent binary.

  • Proxy and Always-On VPNs: Ensure the endpoint is not routing traffic through an unconfigured proxy server or a full-tunnel VPN that breaks outbound agent connectivity during host isolation.

Steps to ensure that the Huntress Agent is running properly on the endpoint and how to restart services:

  1. Open the command-line interface on the endpoint as an administrator.

  2. At the command prompt, run the restart command for your operating system:

    • Windows: Enter net stop HuntressAgent and press ENTER. Follow up with net start HuntressAgent and press ENTER.

    • macOS: Enter sudo launchctl unload /Library/LaunchDaemons/com.huntress.huntressagent.plist and press RETURN. Follow up with sudo launchctl load /Library/LaunchDaemons/com.huntress.huntressagent.plist and press RETURN.

      • For Windows

         

      • For MacOS

     

  3. Refresh the Endpoint Details page to confirm the task status updates to Complete.

Should these steps fail to resolve the Agent being unresponsive:

  1. Open a ticket with Huntress Support.

  2. Include the hostname, organization name, and details of the stuck remediation or host isolation task.

Related articles