"Ingress" agent deleted from Maximum PCs

amcysoc786 Lv1Posted 02 Oct 2023 16:55

Today i am facing an issue in which Ingress client is deleted from my maximum PCs.  I have checked all the logs of Active Directory and Event Viewer but didn't found any artifacts.  
1. Is sangfor IAG has capability to delete an agent unintentionally?
2. What are events ID created during installation/ deletion of agent from systems?

By solving this question, you may help 514 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

mdamores Lv3Posted 09 Oct 2023 14:05
  
Hi,

Sangfor IAG was designed primarily to secure and manage access to network resources but it doesn't have the capability to unintentionally delete clients/agents from PC's.

regarding your question, you may refer below:

1. Is sangfor IAG has capability to delete an agent unintentionally? - IAG's role is more on management of access to resources and doesn't involve in actions life deleting agents or clients on PCs.
2. What are events ID created during installation/ deletion of agent from systems? - specific Event ID during installation or deletion of agents varies depending on the Operating System you are using and the configuration set. However, you may try to find it thru Windows Event Viewer

Please consider that Sangfor IAG will not directly trigger these event unless there is involvement in the process of installation and/or removal. Try to look if there's any automation on the scripts or policies within the organization which affect the agent software on the PCs.
Zonger Lv4Posted 09 Oct 2023 16:22
  
Sangfor IAG (Internet Access Gateway) is a network security solution that provides features like secure remote access, web filtering, and application control. Typically, it doesn't have a built-in capability to delete agents or software from remote systems on its own.

Sangfor IAG Capability:

Sangfor IAG, by design, is not intended to delete agents or software from remote systems unintentionally. It primarily focuses on secure access and controlling network traffic.

If agents or software are being removed from your PCs, it's more likely related to other factors such as system updates, user actions, or third-party software conflicts. Investigate those aspects for the source of the issue.

Event IDs:

Event IDs related to software installation or removal can vary depending on the Windows operating system version and the specific software installation method (e.g., MSI installer, script).

Common Event IDs for software installation and removal in the Windows Event Viewer might include:

             Event ID 11707: This is typically logged when software is installed.
             Event ID 11724: This can be logged when software is removed.

It's essential to note that these event IDs are related to Windows Installer activities. The specific event IDs can vary based on the software deployment method and other factors.
To investigate the removal of agents from your PCs, you should review the event logs on the affected systems for relevant event IDs, error messages, or any indications of software removal. Additionally, check for any scheduled tasks or third-party software that might be involved in this process.
Farina Ahmed Lv5Posted 09 Oct 2023 18:23
  
Sangfor IAG Capability:
Sangfor IAG (Internet Access Gateway) does not have a built-in capability to delete an agent unintentionally. Agent deletion usually requires specific user or administrative actions.

Event IDs for Installation/Deletion:

Installation: Event ID 11707 (Installation initiated)
Deletion: Event ID 11724 (Removal initiated)
jerome_itable Lv2Posted 11 Oct 2023 08:30
  
1. Is Sangfor IAG has capability to delete an agent unintentionally?

Yes, Sangfor IAG has the capability to delete an agent unintentionally. This can happen in a few different ways:

    If the Sangfor IAG is configured to automatically uninstall the agent when a user's computer is no longer connected to the network, the agent may be uninstalled unintentionally if the computer is disconnected for a long period of time.
    If the Sangfor IAG is configured to automatically uninstall the agent when a user's account is disabled or deleted, the agent may be uninstalled unintentionally if the user's account is disabled or deleted accidentally.
    If the Sangfor IAG is configured to allow users to uninstall the agent themselves, the agent may be uninstalled unintentionally if a user uninstalls the agent accidentally.

2. What are events ID created during installation/ deletion of agent from systems?

The following Event IDs are created during installation and deletion of the Sangfor IAG agent:

Installation:

    Event ID 10007: The Sangfor IAG agent is installed successfully.
    Event ID 10008: The Sangfor IAG agent is updated successfully.

Deletion:

    Event ID 10009: The Sangfor IAG agent is uninstalled successfully.

Troubleshooting:

If you are facing an issue with the Sangfor IAG agent being deleted unintentionally, you can troubleshoot the issue by checking the following:

    Check the Sangfor IAG configuration to make sure that the agent is not configured to be uninstalled automatically.
    Check the Event Viewer on the affected computers for the Event IDs listed above. If you find any of these Event IDs, it will indicate when the agent was installed or deleted.
    Check with the affected users to see if they uninstalled the agent themselves.

If you are unable to troubleshoot the issue yourself, you can contact Sangfor support for assistance.
Newbie517762 Lv5Posted 11 Oct 2023 10:04
  
HiHi,

1. Sangfor IAG cannot unintentionally delete an agent.
2. The Windows Event Viewer generates common event IDs for software installation and removal:
   - Event ID 11707: Generated upon successful installation.
   - Event ID 11724: Generated upon successful removal.
RegiBoy Lv5Posted 11 Oct 2023 11:00
  
IAG cannot delete and agent.
GingP Lv2Posted 12 Oct 2023 12:51
  
1. Does sangfor IAG have the potential to accidentally remove an agent? - IAG's job focuses primarily on resource access control and does not include tasks like erasing agents or clients from PCs.
2. What do the events IDs produced while installing or removing agents from systems mean? depending on the Operating System you are running and the settings chosen, different Event IDs may occur during the installation or deletion of agents. However, you might try using Windows Event Viewer to look for it.
Hector Ignacio Lv2Posted 12 Oct 2023 12:52
  
Depending on the Windows operating system version and the individual program installation technique (e.g., MSI installer, script), event IDs relating to software installation or removal might change.

In the Windows Event Viewer, typical Event IDs for program installation and removal can be:

When software is installed, the event ID 11707 is normally logged.
Event ID 11724: When software is uninstalled, this might be recorded.

It is important to keep in mind that these event IDs are connected to Windows Installer operations. Depending on the software deployment technique used as well as other variables, different event IDs may apply.
You should check the event logs on the impacted systems for pertinent event IDs, error messages, or other signs of software removal in order to look into the removal of agents from your PCs. Additionally,
jesspastor Lv2Posted 12 Oct 2023 12:53
  
Installation: Event ID 11707 (Installation initiated)
Deletion: Event ID 11724 (Removal initiated)

I Can Help:

Change

Moderator on This Board

11
54
1

Started Topics

Followers

Follow

15
21
3

Started Topics

Followers

Follow

Board Leaders