Fix Endpoint Agent Heartbeat Lost on Windows 10 22H2

When This Error Shows Up

You're checking your security console and see a red blinking warning: Heartbeat Lost. The agent on Windows 10 22H2 (or Windows 11 23H2) stopped reporting in. This happens most often after a Windows Update (like KB5034441) or when someone changes the network adapter settings. I've seen it on laptops that switch from Wi-Fi to Ethernet. The agent just stops. It's infuriating, I know.

Root Cause – Why It Happens

The agent uses a small service to send a heartbeat packet to your server every 30 seconds. If the service crashes, gets blocked by a firewall, or the agent configuration becomes corrupt, the server never receives the packet. The common triggers:

• A firewall rule (Windows Defender Firewall or a third-party) blocked the agent's port.
• The agent's internal service (like CbDefense or Sense for Defender) stopped and didn't restart.
• A proxy server is interfering with the connection.
• The Windows Update process broke the agent's registry keys.

Fix – Step by Step

Try these steps in order. Don't skip. I've wasted hours jumping around. Start here.

1. Check firewall rules. Open Windows Defender Firewall with Advanced Security. Look for inbound rules that block your agent's executable. For example, C:\Program Files\Cb Defense\CbDefense.exe or C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12\MsMpEng.exe. If there's a block rule, disable it. Then restart the agent service.
2. Restart the agent service manually. Open Services.msc. Find the agent service name – it's usually Carbon Black Defense, Microsoft Defender for Endpoint, or Symantec Endpoint Protection. Right-click and choose Restart. Wait 2 minutes. Check the console again.
3. Check the proxy settings. If your network uses a proxy, the agent might not know about it. Open the agent configuration file. For Defender, it's in C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24010.12\config. Look for ProxyServer and ProxyPort. Set them correctly. Example: ProxyServer: proxy.yourcompany.com and ProxyPort: 8080.
4. Repair the agent installation. Open Control Panel > Programs > Programs and Features. Find your agent. Right-click and choose Repair. This re-registers the service and DLLs. Restart the computer after it finishes.
5. Run a network connectivity test. Open Command Prompt as Admin. Type telnet your-server-ip 443 (or the port your agent uses). If it fails, the port is blocked. Replace with 443 for Defender or 5555 for older agents. Also run ping your-server-ip. No reply means network issue.

When It Still Fails

If the heartbeat stays lost after these steps, the agent config might be corrupt. Here's what to check:

• Event Viewer logs. Open Event Viewer > Windows Logs > Application. Look for errors from your agent's source. Common ones: Source: CbDefense with Event ID 1 or 100. Double-click the error. It often says "cannot connect to server" or "config file missing".
• Registry keys. Open Regedit. Go to HKEY_LOCAL_MACHINE\SOFTWARE\ThreatGuard (or your vendor's path). Look for a ServerURL value. If it's blank or wrong, set it to your management server. Example: https://your-server.company.com:443.
• Reinstall the agent. If nothing works, uninstall the agent from Programs and Features. Restart. Download a fresh installer from your console. Install as admin. This is the nuclear option, but it fixes 99% of heartbeat lost cases.

Pro tip: Check Task Scheduler for a missed task. Some agents (like Symantec) run a heartbeat through a scheduled task. If the task is disabled, the agent looks alive but never sends a packet.

If you're still stuck, your server might be the issue. Restart the management server from your console. I've seen a bug in Carbon Black 7.9.2 where the server drops connections after 48 hours. A server restart clears that.