Disconnected Agent Due To WinHttpSendRequest Error 12007

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Agent is showing as Disconnected.
• Disconnected Agent Logs reveal messages similar to the following in the Trace.bt9 file:

Server Communication: WaitForResponse End: m_bIsSleeping[0] IsSleeping[0] GetHttpStatus[0] GetWinHttpError[12007] GetSslError[0] DataAvailable[0]
Server Communication: WaitForResponse: WAIT_OBJECT_DATA_AVAILABLE_EVENT
Server Communication: WinHTTP communication error: 12007

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

Microsoft defines the WinHttpSendRequest Error[12007] as:

ERROR_WINHTTP_NAME_NOT_RESOLVED: 12007
The server name cannot be resolved.

Typically this happens when a networking issue is preventing the endpoint from resolving the Server Address:

Resolution

1. Use a command prompt to issue the following commands:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli status

2. In the returned output, locate: Server Information > Server and note the address.
   Example: appserver.domain.com:41002 means the Server Address is appserver.domain.com
3. Verify traffic between the endpoint and Server Address is not blocked by the firewall.
4. Attempt to connect to that Server Address via the PowerShell command:

   tnc -ComputerName YourServerAddress -Port 41002 -InformationLevel "Detailed"

5. In some instances a Proxy is preventing this communication. Issue the following to verify if a Proxy is present, and issue a Proxy reset if present:

   netsh winhttp show proxy
   netsh winhttp reset proxy

6. Attempt a winsock reset, then reboot the endpoint:

   netsh winsock reset

If the issue persists, open a case with Support and provide the Disconnected Agent Logs with a Wireshark capture.