Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

"Contact by Unrecognized Client" system event encountered in Vulnerability Protection Manager (VPM) 2.0

    • Updated:
    • 21 Nov 2016
    • Product/Version:
    • Vulnerability Protection 2.0
    • Platform:
    • Windows 2003 Server R2
    • Windows 2008 Enterprise 64-bit
    • Windows 2008 Server R2
    • Windows 2008 Server R2 Enterprise
    • Windows 2012 Server Essential R2
    • Windows 2012 Standard R2
    • Windows 7 32-Bit
    • Windows 7 64-Bit
    • Windows 8 32-Bit
    • Windows 8 64-Bit
    • Windows 8.1 32-Bit
    • Windows 8.1 64-Bit
    • Windows Vista 32-bit
    • Windows Vista 64-bit
    • Windows XP Professional
    • Windows XP Professional 64-bit
    • Windows XP SP2 32-bit
    • Windows XP SP3 32-bit
Summary

The warning level system event message "Contact by Unrecognized Client" appears when the following conditions are present:

  • An OfficeScan (OSCE) connector is created in VPM for OSCE agent synchronization.
  • The option “Delete endpoints and groups when they are removed from the OfficeScan server” is enabled in OSCE (disabled by default).
  • The Vulnerability Protection Agent is installed on the OfficeScan endpoint offering Firewall and Intrusion Prevention System (FW/IPS) protection.
  • The OSCE agent switches to roaming mode, and the OfficeScan server removes the agent from its management tree.
    VPM will also remove the computer information after synchronization completes.
  • The agent reconnects to the OfficeScan Server after a few days.

When the Vulnerability Protection Agent (VPA) reconnects to VPM, VPA will receive a connection refused error with VPM displaying the warning level event, "Contact by Unrecognized Client".

Contact by Unrecognized Client

Details
Public

The VPA (Agent GUID or virtual ID) is removed from VPM because the "Delete endpoints and groups when they are removed from the OfficeScan server" option is enabled in the console. When the VPA comes back online and tries to connect to VPM, the error appears because the VPA is no longer present in the VPM agent list.

Check if the option is enabled by doing the following:

  1. In the VPM web console, click the Computers tab.
  2. In the left panel, right-click the OSCE group and select Properties.
  3. In the Properties pop-up window, go to the Settings tab.
    Delete endpoints and groups

You can also verify if these settings are enabled in the VPM diagnostic log -> debug.xml file.

Debug.xml

Prevent the issue from occurring by creating an Event-Based Task (EBT) to activate the VP agent automatically when it comes back online and synchronizes with the OfficeScan Server.

  1. In the VPM console, go to the Administration tab.
  2. Click Event-Based Tasks > New.
  3. Create a “Computer Created” Event-based Task to reactivate the VP agent when it comes back online and synchronizes with the OfficeScan Server.
    Reactivation Task
  4. Once the VPM receives the system event and the target VP agent matches the EBT condition, activation will be triggered. You can verify this under Events & Reports.
    Events and Reports
  5. Under the Computers tab, the VP Agent status will change from Activating (Delayed) to Managed (On-line).
    Activating (Delayed) status

    Managed (On-line) status

The system event with warning level “Contact by Unrecognized Client” should no longer occur in VPM.

Premium
Internal
Rating:
Category:
Troubleshoot
Solution Id:
1115226
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.


Need More Help?

Create a technical support case if you need further support.