VMware vsepflt.sys driver is used by Deep Security Anti-Malware feature. When a virtual machine (VM) is powered off, Deep Security Manager (DSM) will receive the status including the "Driver Offline" status. Once the VM is powered on again, Deep Security Virtual Appliance sends heartbeat to report the agent status. However, when the vsepflt.sys driver is not yet loaded, Deep Security Manager may receive the "Driver Offline" status. By default, the agent sends heartbeats to DSM every 10 minutes. If the driver is loaded in the next heartbeat, the engine's offline status would be back to online. In this case, no action is required.

You can also trigger the Check Status button to get the status immediately. If the driver is already loaded, the Anti-Malware engine status will show online.

If the status of Anti-Malware remains offline, check if the driver has been loaded.

1. On the virtual machine, open cmd.exe with administrator permission.
2. Run the "fltmc" command and verify if the vsepflt driver exists.

   

3. If vsepflt is not yet loaded, run the "fltmc load vsepflt" command to manually load the driver.