The warning level system event message "Contact by Unrecognized Client" appears when the following conditions are present:
- An OfficeScan (OSCE) connector is created in VPM for OSCE agent synchronization.
- The option “Delete endpoints and groups when they are removed from the OfficeScan server” is enabled in OSCE (disabled by default).
- The Vulnerability Protection Agent is installed on the OfficeScan endpoint offering Firewall and Intrusion Prevention System (FW/IPS) protection.
- The OSCE agent switches to roaming mode, and the OfficeScan server removes the agent from its management tree.
VPM will also remove the computer information after synchronization completes. - The agent reconnects to the OfficeScan Server after a few days.
When the Vulnerability Protection Agent (VPA) reconnects to VPM, VPA will receive a connection refused error with VPM displaying the warning level event, "Contact by Unrecognized Client".
The VPA (Agent GUID or virtual ID) is removed from VPM because the "Delete endpoints and groups when they are removed from the OfficeScan server" option is enabled in the console. When the VPA comes back online and tries to connect to VPM, the error appears because the VPA is no longer present in the VPM agent list.
Check if the option is enabled by doing the following:
- In the VPM web console, click the Computers tab.
- In the left panel, right-click the OSCE group and select Properties.
- In the Properties pop-up window, go to the Settings tab.
You can also verify if these settings are enabled in the VPM diagnostic log -> debug.xml file.
Prevent the issue from occurring by creating an Event-Based Task (EBT) to activate the VP agent automatically when it comes back online and synchronizes with the OfficeScan Server.
- In the VPM console, go to the Administration tab.
- Click Event-Based Tasks > New.
- Create a “Computer Created” Event-based Task to reactivate the VP agent when it comes back online and synchronizes with the OfficeScan Server.
- Once the VPM receives the system event and the target VP agent matches the EBT condition, activation will be triggered. You can verify this under Events & Reports.
- Under the Computers tab, the VP Agent status will change from Activating (Delayed) to Managed (On-line).
The system event with warning level “Contact by Unrecognized Client” should no longer occur in VPM.
