When a machine will not install, will not appear, or has gone quiet
Troubleshooting the GoTenix agent
The five problems techs meet most with the agent, each with what you see, why it happens and what to do, from a failed install to an update that did not finish.
Browse
On this page
How to do it
Problem: the install fails or the machine never appears.
What you see: msiexec ends with 1603, or the exe installer ends with a code. In the portal the Install issues button at the right end of the Devices bar is red. It opens Installs that need attention, a list of machines that tried to join and did not. Why: the install worked, but the machine did not connect. The installer waits up to 90 seconds for the machine to reach the portal. The service, its files and its logs stay. If the service starts, the agent keeps trying on its own, so a 1603 can still turn into a working machine later. If Windows refuses to start the service (see the problem on Windows refusing to start the agent), nothing is retrying until you allow it. What to do: open the row and press View report. It lists the steps and the log. On the PC, open Event Viewer, Windows Logs, Application, and look for source GoTenix Agent, event ID 1700. The same line is in C:\Program Files\GoTenix Agent\data\logs\install.log.
Read the reason the portal gives.
A row says what stopped it: Install stopped, Service kept stopping, Service reported down, or Installed, never connected. For never connected, the portal says the install link may be used up, or the device cannot reach the portal. The exe installer ends with a code your script can read. 0 is connected. 10 means the credential was refused or has expired: get a fresh installer. 11 means the machine could not have a usable talk with the portal: DNS, a firewall or web filter, TLS inspection, or something else answering. 12 means the agent failed or the install had no portal details. 13 means it is still trying and is not a failure. 15 means another agent used this machine's identity less than 15 minutes ago (see below). 16 means Windows itself would not start the service: a security tool blocked the program. Allow it by publisher (allow page, steps 4 and 6), then run Start-Service GoTenixAgent. For code 11, go to the allow page and check the names, the port and the TLS inspection bypass.
Run the install silently the right way.
For a push from Group Policy, Intune or your RMM, run this as SYSTEM or from an elevated prompt, once on each machine: msiexec /i GoTenixAgent.msi /qn ADDDESKTOPICON=1 ENROLLURL="<link>" Quote the link, because it is long. Drop ADDDESKTOPICON=1 if you do not want the desktop shortcut. Without ENROLLURL a new machine refuses the install. For the exe, give -enroll-url "<link>" and -yes, and run it with start /wait or Start-Process -Wait so your script can read the code. An ordinary prompt stops at a permission window that no job can answer.
Know the quiet exit 0.
The MSI runs a last check step after the install is done. If that step cannot get administrator rights, it does not show an error. It writes one line to install.log and to the Event Log, that says it could not elevate to wait for enrolment and that the service is installed and retrying, and it ends with 0. So a success code does not prove the machine connected. Look for the machine in Devices, or read the line in install.log.
Problem: the agent shows offline but the PC is on.
What you see: in RMM, then Devices, the machine's Last check-in is old and its status is Offline. The Status filter on the bar lets you list them. Why: each agent checks in about every 25 seconds, unless your policy sets a longer interval (up to 5 minutes). The portal shows a machine as Offline when its last check-in is older than three check-in intervals, and never sooner than three minutes. A stopped service, a blocked network, or a security tool that killed the program all look the same from the portal. What to do: on the PC, run Get-Service GoTenixAgent in PowerShell. If it is stopped, run Start-Service GoTenixAgent. If it will not start, read C:\Program Files\GoTenix Agent\data\logs\agent.log. If it starts and goes offline again, check the network names on the allow page.
Problem: Windows refuses to start the agent.
What you see: Start-Service GoTenixAgent, or the Services window, says Access is denied (error 5). Why: a common cause is security software. Application control such as ThreatLocker, an EDR product and an antivirus product can each block a program from starting, or quarantine its file. The block can start after an update, because the update is a new file. What to do: allow the program in each tool you run, by publisher or by the folder C:\Program Files\GoTenix Agent\ (the allow page lists what to add). If a tool moved the file to quarantine, restore it first. Then run Start-Service GoTenixAgent.
Problem: an update did not finish.
What you see: the Agent column keeps the old version, and the Health line says a newer agent version is available. On the PC, GoTenixAgent.exe.update, GoTenixAgent.exe.prev or GoTenixAgent.exe.rejected may sit in the install folder. Why: the agent downloads the update, writes it as GoTenixAgent.exe.update, swaps it in and restarts. If the new program does not check in within three starts, the agent puts the old one back and renames the new one to GoTenixAgent.exe.rejected. A security tool that blocks the new file or the rename causes this. What to do: allow the folder and the publisher so files can be created and renamed there. Hash-only rules fail after an update. Then start the service.
Problem: the agent is blocked at the network.
What you see: Installed, never connected in the install list, install code 11, or event 1700 with words about DNS, the secure connection or the portal address. Why: the PC cannot look up or reach the portal address or the agent address on port 443, a filter changes the answer, TLS inspection re-signs the traffic, or the PC clock is wrong. What to do: open the allow page and add the names, port and bypass it lists. Check that the PC clock is right, then restart the service.
The pages behind each click
What you will have
- Match what you see on the portal or on the PC to the likely cause.
- Find the log or event that says why.
- Know the first thing to try for each problem.
Why it works this way: Troubleshooting the GoTenix agent
Most agent problems are one of three things: the machine cannot reach the portal, a security tool blocks the program, or the install credential was used up. Each one leaves a clue in the portal and on the PC.
The install keeps the service and its logs after a failed start, so a failed install is a report to read, not a mess to clean up first. If the service starts, the agent keeps trying on its own. If Windows refuses to start it, nothing is retrying until you allow it.
If it did not work: Troubleshooting the GoTenix agent
- Nothing in Event Viewer or install.log after an MSI push: a new machine refuses the install when ENROLLURL is missing, and nothing else is written. Add /l*v C:\gotenix-agent-install.log to the push to catch it.
- The installer ends with code 15: another agent checked in with this machine's identity less than 15 minutes ago. After an install over an older agent this is expected, so do not run the installer again. The machine connects by itself within about 20 minutes. If a copied machine has still not connected after 20 minutes, choose Enroll as new device in the tray.
- An old PC lists the agent's service under the old product name: it runs under the old names and needs a fresh install.
Questions this page answers
Why does the RMM agent install end with error 1603?
The install worked but the machine did not connect to the portal within 90 seconds, and the service stays installed (if it started, it keeps trying), so read event 1700 in the Application log.
Where do I find the agent's install log?
Open C:\Program Files\GoTenix Agent\data\logs\install.log, or the Application log in Event Viewer under source GoTenix Agent.
Why does the agent show offline when the PC is on?
The portal shows a machine as Offline when its last check-in is older than three check-in intervals, so the service may be stopped, blocked by security software, or unable to reach the network.
What does Access is denied mean when I start the agent service?
Windows error 5 means something refused to let the program start, often application control, an EDR or antivirus, so allow the agent there and run Start-Service GoTenixAgent.
What should I do when an agent update does not finish?
Allow the install folder and the publisher in your security tools so the update can create and rename files, then start the service.
Was this helpful?