The Dissolvable Agent Server Outlier Vault Service did not start automatically.

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

After installation, the Dissolvable Agent Server Outlier Vault Service did not start automatically.

Some or all of the following errors may occur:

• Windows could not start the Outlier Vault Service on Local Computer.
   
• Error 1053: The service did not respond to the start or control request in a timely fashion.
   
• In System Log of Windows Event Viewer:
  7031 The Outlier Vault Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds Restart the service.
   
• In C:\Program Files (x86)\OutlierVault\logs, logs similar to the following, with different timestamps may appear:
  [2019-09-10 08:26:53.7740][DEBUG][DataVault][13][Vault registration info is missing. Machine needs registration.]
[2019-09-10 08:26:53.7740][DEBUG][DataVault][13][Starting initial registration...]
[2019-09-10 08:26:53.7740][ERROR][DataVault][13][Exception during registration: No registration token found]

Resolution

 

To diagnose

1. If logs similar to the following appear in C:\Program Files (x86)\OutlierVault\logs, the hash key is not being written to registry during the DAS install. To repair, perform a manual un-install of service, then re-install.
   [2019-09-10 08:26:53.7740][DEBUG][DataVault][13][Vault registration info is missing. Machine needs registration.]
[2019-09-10 08:26:53.7740][DEBUG][DataVault][13][Starting initial registration...]
[2019-09-10 08:26:53.7740][ERROR][DataVault][13][Exception during registration: No registration token found]
   
    
2. Else, 3rd party protection delays the startup of unknown services for inspection and prevents startup within 30 seconds. To workaround, extend the ServicesPipeTimeout period

 

 

To perform a manual un-install of service

1. Disable the DataVault
2. Delete the EDRC Vault service
3. Delete the EDRC Vault files
4. Delete the EDRC Vault registry key

 

To disable the DataVault

1.  Open an Administrator command prompt.
2.  Type: net stop OUTLIERVAULTSVC
3.  Press Enter.

 

To delete the EDRC Vault service

1. Open an Administrator command prompt window.
2. Type: sc delete OUTLIERVAULTSVC
3. Press Enter.
4. Close the command prompt window.

 

To delete the EDRC Vault files

1.  Navigate to the Program Files (x86) directory for 64-bit OS’s; Program Files for 32-bit OS’s.
2.  Scroll down to the EDRCVault folder.
3.  Select the folder and press the Delete key.
4.  Confirm the folder deletion.

 

To delete the EDRC Vault registry key

1. Open the Registry Editor window.
2. For 64-bit OS, go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OutlierSecurity
3. For 32-bit OS, go to HKEY_LOCAL_MACHINE\SOFTWARE\OutlierSecurity
4. Select the OutlierSecurity registry key folder and press the Delete key.
5. Confirm the folder deletion.

 

 

To extend the ServicesPipeTimeout period

1. Click Start > Run, type regedit, and then click OK.
2. Locate and then click the registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
3. In the right pane, locate the ServicesPipeTimeout entry.
4. If the ServicesPipeTimeout entry does not exist, you must create it. Follow these steps:
   ■ On the Edit menu, point to New, and then click DWORD Value.
   ■ Type ServicesPipeTimeout
   ■ Press Enter.
5. Right-click ServicesPipeTimeout, and then click Modify.
6. Click Decimal, type 60000
7. Click OK. This value represents the time in milliseconds before a service times out.
8. Restart the computer.