Troubleshoot Arctic Wolf Resolve

This informations contains solutions for troubleshooting Arctic Wolf Resolve.

Note: If you open a support ticket, provide results of a debug scan if possible. For more information, see Run an Arctic Wolf Agent debug scan.

Device does not work after a patch

If a device does not work after Arctic Wolf Resolve applies a patch, restore the device to its state before the patch.

  • The patch did not install correctly.
  • A file is corrupted.
  • Your device needs updated drivers.
  1. Contact your Concierge Security® Team（CST） and ask them to pause upcoming patches to your device.
  2. Uninstall the update. If you can still access your settings, go to Settings > Windows Update > Update history > Uninstall updates and remove the most recent patch.
  3. Boot your device into Safe Mode.
    Safe Mode loads only essential drivers. If the system is stable in Safe Mode, a third-party driver or app is likely the culprit.
  4. Open Command Prompt as an administrator and run these commands to fix corrupted files:
    CODE 
    sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
  5. Revert your PC to a state before the update using a previously created restore point.
  6. Download the latest drivers from the device manufacturer website, especially for your graphics card and BIOS.

Unable to patch software variant

When a product is detected through Arctic Wolf Resolve, patching may only be available for some variants of the product.

Each software product can have multiple variants. Products may have different:
  • Architectures, for example, x86 and x64
  • Installer types, for example, MSI and executable
  • Distribution channels, for example, desktop installer and
Arctic Wolf Resolve may be unable to patch certain variants if the vendor has discontinued the product or version installed on the endpoint or third-party patching tools aren't supported.

The application was distributed through the . The does not permit third-party patching tools like Arctic Wolf Resolve to maintain updates.

  1. Allow the to manage updates for these applications automatically.
  2. If possible, migrate to the desktop installer version of the application.

The software uses an architecture or installer that the vendor no longer supports. For example, dropping a 32-bit build. When the vendor discontinues a variant, there is no installer available to update the product.

Migrate affected endpoints to a supported variant or architecture of the same product.

The product line is discontinued. Vendors often maintain multiple product lines in parallel. For example, a current release and a legacy long-term support release. When a vendor stops servicing an older release line, Arctic Wolf Resolve discontinues patching support for that line.

  1. Use Aurora VM detection data to identify endpoints running end-of-life software.
  2. Migrate to a supported release line.

Determine the variant of a product that is installed on an endpoint

You can look at additional information to see which variant of a product is installed on an endpoint.

Examine these:

  • Registry hive location — HKEY_LOCAL_MACHINE indicates a system-wide installation, while HKEY_CURRENT_USER indicates a per-user installation.

  • Uninstall string format — MSI-based installations referencing msiexec, executable-based installations referencing a vendor uninstaller, and applications have a distinct package format.