We have two windows domain controllers that have Kace agent ver. 10.1.43 installed on them. On both servers on a consistent every six hours, we are seeing the ampwatchdog.exe start up the netstat.exe process. Why would it be doing this?

I have tried to look for any script or scheduled job and have come up empty.

0 Comments   [ + ] Show comments

Answers (2)

Posted by: Nico_K 11 months ago
Red Belt

Let me guess:
You set the check in interval to 6hr.
And short after the tasks are started the inventory is updated for the system in question.

  • Device Inventory was set to every four hours. I just changed it to 12 hours to see if I see a change in interval. - KJessie 11 months ago
    • please check where you have the agent inventory (Settings | Provisioning | Communication settings) if any of the settings is set to 6hr

      Also you can run a KAT directly after it occured and check the agent logs which agent tasks were running. If you are unsure you can check with support to analyze these logs. - Nico_K 11 months ago
      • Running KAT ver 1.0.20 with server admin account and it will not load, gives me the "Error creating child process. The requested operation requires elevation." - KJessie 11 months ago
      • please open a SR with support for that - Nico_K 11 months ago
    • Still seeing these events on a 6 hour cycle. - KJessie 11 months ago
Posted by: scottcopus 11 months ago
Senior Yellow Belt

Sysinternals Process Monitor (or maybe Process Explorer) is great for this.  When using Process Monitor, after you catch that the netstat.exe process is launched, you can open up its Process Tree (under Tools) to see a tree-view process history.  Examining the command-lines of processes in question may also help.

This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ