Systems Management Question

We have two windows domain controllers that have Kace agent ver. 10.1.43 installed on them. On both servers on a consistent every six hours, we are seeing the ampwatchdog.exe start up the netstat.exe process. Why would it be doing this?

05/20/2020 575 views

I have tried to look for any script or scheduled job and have come up empty.

0 Comments   [ + ] Show comments


All Answers


Let me guess:
You set the check in interval to 6hr.
And short after the tasks are started the inventory is updated for the system in question.

Answered 05/20/2020 by: Nico_K
Red Belt

  • Device Inventory was set to every four hours. I just changed it to 12 hours to see if I see a change in interval.
    • please check where you have the agent inventory (Settings | Provisioning | Communication settings) if any of the settings is set to 6hr

      Also you can run a KAT directly after it occured and check the agent logs which agent tasks were running. If you are unsure you can check with support to analyze these logs.
      • Running KAT ver 1.0.20 with server admin account and it will not load, gives me the "Error creating child process. The requested operation requires elevation."
      • please open a SR with support for that
    • Still seeing these events on a 6 hour cycle.

Sysinternals Process Monitor (or maybe Process Explorer) is great for this.  When using Process Monitor, after you catch that the netstat.exe process is launched, you can open up its Process Tree (under Tools) to see a tree-view process history.  Examining the command-lines of processes in question may also help.

Answered 05/26/2020 by: scottcopus
Senior Yellow Belt

This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ