6.7 Agent Troubleshooting

The CertKit Agent is designed to install and run without special configuration, but endpoint security tooling on the host can interfere with it. This page collects problems we’ve observed in the field.

Before digging further, the following commands (from an elevated powershell prompt) can tell you a lot of what the agent is doing (or not doing).

Get-Content "C:\ProgramData\CertKit\certkit-agent\certkit-agent.log" -Tail 200
& "C:\Program Files\CertKit\bin\certkit-agent.exe" validate --config "C:\ProgramData\CertKit\certkit-agent\config.json"

Symptom: The agent won’t install or can’t upgrade

The install snippet completes but the certkit-agent service is missing or won’t start. Or the agent installed fine, but auto-updates repeatedly fail on one host while the rest of the fleet updates normally. In some cases certkit-agent.exe disappears from C:\Program Files\CertKit\bin shortly after installation.

The most common cause is a Microsoft Defender Attack Surface Reduction (ASR) rule blocking the agent binary. ASR rules are host-hardening policies that sit alongside normal antivirus scanning, and the rule Block executable files from running unless they meet a prevalence, age, or trusted list criterion is particularly aggressive: it blocks executables that Microsoft’s cloud hasn’t seen widely, which can include a newly released CertKit Agent build. ASR maintains its own exclusion list, so a standard Defender Antivirus file exclusion is not guaranteed to bypass it.

Confirm ASR is blocking the agent

ASR blocks are recorded in the Windows Defender operational event log:

1. Open Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.
2. Filter the log for Event ID 1121 (an ASR rule fired in block mode). Event ID 1122 is the same event in audit mode.
3. Look for events referencing certkit-agent.exe or C:\Program Files\CertKit, timestamped around the failed install or upgrade.

A matching event reads “Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator” (Exploit Guard is the Defender component that enforces ASR rules), with the agent binary in the Path field. The Process Name is often C:\Windows\System32\services.exe — that’s the Windows Service Control Manager being blocked from starting the agent service, not a problem with services.exe itself.

Or query the same log from an elevated PowerShell prompt:

Get-WinEvent -FilterHashtable @{ LogName = "Microsoft-Windows-Windows Defender/Operational"; Id = 1121, 1122 } |
    Where-Object { $_.Message -match "certkit" } |
    Format-List TimeCreated, Message

The event message names the GUID of the ASR rule that fired. 01443614-cd74-433a-b99e-2ecdc07bfc25 is the prevalence/age/trusted-list rule described above; Microsoft’s ASR rules reference maps every GUID to its rule name.

You can also list which ASR rules are active on the host:

Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

Actions map to: 0 = disabled, 1 = block, 2 = audit, 6 = warn.

If there are no 1121 or 1122 events around the failure time, ASR isn’t the problem — check the agent log and the install output for the actual error. On older Windows Server hosts, see Legacy Windows Installs.

Add an ASR allow rule for the agent binary

Exclude the agent binary from ASR evaluation. On a host where Defender is managed locally, run from an elevated PowerShell prompt:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\CertKit\bin\certkit-agent.exe"

Confirm it took effect:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionOnlyExclusions

ASR-only exclusions apply across all ASR rules, so this works regardless of which rule GUID appeared in the event log. If your 1121 events reference a different path — for example, a staging file written during an upgrade — exclude the whole C:\Program Files\CertKit\bin folder instead of the single executable.

If Defender is managed centrally (Intune, Group Policy, or Configuration Manager), a local Add-MpPreference change will be ignored or overwritten the next time policy syncs. Add the exclusion in the management tool instead:

• Group Policy: Computer Configuration → Administrative Templates → Windows Components → Microsoft Defender Antivirus → Microsoft Defender Exploit Guard → Attack Surface Reduction → Exclude files and paths from Attack Surface Reduction Rules. Enable the setting and add C:\Program Files\CertKit\bin\certkit-agent.exe as the value name, with a value of 0.
• Intune: Endpoint security → Attack surface reduction → your ASR policy → Attack Surface Reduction Only Exclusions → add the path.

Verify the fix

Re-run the install snippet from the Agents page, or trigger the update again from the agent detail page. Then confirm the service is running and no new 1121 events appeared:

Get-Service certkit-agent
Get-Content "C:\ProgramData\CertKit\certkit-agent\certkit-agent.log" -Tail 50

Symptom: Install fails with “Could not create SSL/TLS secure channel”

Windows Server 2012 R2 and some older Windows Server 2016 builds use PowerShell defaults that can’t negotiate TLS 1.2 for the installer download. See Legacy Windows Installs for the one-line fix and a compatible install command.