Understanding status details for a resilient application

The Status details column in the Application Resilience report contains data if an application has a Status of Not compliant or if the application has recently been remediated. For information on resolving issues, see Troubleshooting non-compliant devices.

Health checks

Each application has a series of health checks that are tested by the RAR component A lightweight software component of the Secure Endpoint Agent that detects the status of third party applications installed on a device. The component may also attempt to repair the third party application if it is non-compliant. The RAR component is deployed on a device only when the device is associated with a customized policy group and that policy group's Application Resilience policy is activated. when the application's Application Resilience policy is configured and activated. For most applications, the RAR component checks to make sure the version installed on the device matches the version configured in the policy. In addition, each application has its own set of health checks that the RAR component tests. The health checks are tested one at a time, until an error is encountered or until they are complete. When an error is encountered, the application reports a Status of Not compliant. Status details shows information about the health check that failed. For example:

The policy is configured with the Repair only option selected. The RAR component detects that the application is not installed. The application reports a Status of Not Compliant. Because Repair only is selected, the RAR component doesn't make any attempts to remediate the problem. Status details shows the following: Application not installed.

For BitLocker and Microsoft SCCM, the RAR component doesn't stop testing health checks when an error is encountered. Every health check is tested for these applications, and all the errors are listed in Status details.

Remediation

If the Report and repair, Report and reinstall, or Report, repair, and reinstall option is enabled in the Application Resilience policy configuration, the RAR component attempts to remediate the application. If the repair or reinstall is successful, Status changes to Compliant, and Status details shows information about the health check that failed, followed by THEN, and that the repair or reinstall was successful.

Example

The policy is configured with the Report, repair, and reinstall option selected. The RAR component detects that the application is not installed. The RAR component attempts to reinstall the application and the reinstall is successful. The application shows a Status of Compliant. Status details shows the following: Application not installed. THEN reinstall succeeded.

If the repair or reinstall fails, Status stays Not compliant, and Status details shows information about the health check that failed, followed by THEN, which part of the repair or reinstall failed, and the reason why it failed.

Example

The policy is configured with the Report, repair, and reinstall option selected. The RAR component detects that the application is not installed. The RAR component attempts to reinstall the application and the reinstall fails. The application shows a Status of Not compliant. Status details shows the following: Application not installed. THEN installer download failed. Hash does not match. Actual: [Hash that was detected] Expected: [Hash that was expected]

In some cases, the application is reinstalled successfully, but the application is still non-compliant. For example, an application may have been reinstalled with the installer provided in the policy configuration, but the installer was for a different application. In this case, the application still reports a Status of Not compliant. Where possible, Status details contains a recommended action to resolve the problem.

Example

The policy is configured with the Report, repair, and reinstall option selected. The RAR component detects that the application is not installed. The RAR component attempts to reinstall the application and the reinstall is successful. The RAR component retests the health checks, and detects that the application still isn't installed. The application shows a Status of Not compliant. Status details shows the following: Application not installed. THEN reinstall completed but the application is not installed. Make sure the installer provided in the policy configuration is for the correct application.

Some applications require a reboot after the application is reinstalled. When the reinstall is complete, the application reports a Status of Not compliant, and indicates that a reboot is pending. The next time the RAR component runs on the device after the device is restarted, and the information is uploaded to the Absolute Monitoring Center, the application reports a Status of Compliant, and Status details shows No Data.

Example

The policy is configured with the Report, repair, and reinstall option selected. The RAR component detects that the application is not installed. The RAR component attempts to reinstall the application and the reinstall is successful. The application requires a device restart after installation. The application shows a Status of Not compliant. Status details shows the following: Application not installed. THEN reinstall completed but reboot pending.