Huntress Platform - Troubleshooting Stuck Remediations and Host Isolation Releases

Team: Huntress Managed Endpoint Detection and Response (EDR)

Product: Huntress Platform

Environment: Cross-platform (Windows, macOS)

Summary: Learn how to troubleshoot pending or stuck remediation actions and host isolation release tasks directly from an active incident report.

If the remediations, host isolation or release of isolation is stuck, follow the steps below to troubleshoot and determine the cause.

Steps to ensure the endpoint is powered on and responding to the Huntress Dashboard.

1. From the upper left data fields in the incident report, select the affected endpoint name under "Entity" to open the Endpoint Details page in the Huntress dashboard.

1. Review the Last Seen timestamp to confirm that the endpoint is powered on and connected to the internet. If the endpoint is powered off or falls into sleep mode, this will result in the endpoint disconnecting from the internet and failing to resolve traffic from the Huntress agent back to our dashboard to update the remediations and or release of isolation. This will increase the Last Seen time and indicate the Agent is not able to resolve traffic back to our dashboard to update its status.

Further investigation steps to check the items below are not causing Agent unresponsiveness.

• DNS Resolution: Ensure the endpoint can resolve hostnames. When isolated, the Huntress Agent falls back to public DNS (1.1.1.1:53/udp). If outbound UDP traffic on port 53 is blocked by network rules, isolation status can't be verified and may be displayed as Pending in the dashboard when it may actually be isolated.

  Relevant Links: 

  • https://support.huntress.io/hc/en-us/articles/4404960349459-Managed-Host-Isolation-Overview

  • https://support.huntress.io/hc/en-us/articles/4404012757139-Required-Firewall-Settings-for-the-Huntress-Agents-Port-Exclusion-and-Allow-List

• Third-Party Security Software: Verify that secondary endpoint protection tools or third-party firewalls are not blocking the Huntress Agent binary.

• Proxy and Always-On VPNs: Ensure the endpoint is not routing traffic through an unconfigured proxy server or a full-tunnel VPN that breaks outbound agent connectivity during host isolation.

Steps to ensure that the Huntress Agent is running properly on the endpoint and how to restart services:

1. Open the command-line interface on the endpoint as an administrator.

2. At the command prompt, run the restart command for your operating system:

   • Windows: Enter net stop HuntressAgent and press ENTER. Follow up with net start HuntressAgent and press ENTER.

   • macOS: Enter sudo launchctl unload /Library/LaunchDaemons/com.huntress.huntressagent.plist and press RETURN. Follow up with sudo launchctl load /Library/LaunchDaemons/com.huntress.huntressagent.plist and press RETURN.

     • For Windows

       

        

     • For MacOS

       

    

3. Refresh the Endpoint Details page to confirm the task status updates to Complete.

Should these steps fail to resolve the Agent being unresponsive:

1. Open a ticket with Huntress Support.

2. Include the hostname, organization name, and details of the stuck remediation or host isolation task.