EDR Agent Shows Offline – Fix in 5 Steps

You log into your EDR console and see a red triangle next to a workstation. Agent status: offline. The user swears the internet is fine—they can browse YouTube, check email, everything. But the EDR agent won't connect. This usually happens after a network change, a security software update, or when someone tinkers with Windows Firewall. I've seen it on Windows 10 and 11 with CrowdStrike Falcon, SentinelOne, and Carbon Black. The agent's heartbeat stops, and the console thinks the machine is dead.

What's Really Going On

The EDR agent isn't a browser. It doesn't use HTTP like Chrome does. It talks to its cloud backend using a specific port (usually 443 for HTTPS, but sometimes 8080 or 8443 for proxy setups). The agent also needs to resolve the cloud server's domain name through DNS. If the DNS cache is stale, or the proxy settings changed, the agent can't phone home. The service might be stuck too—sometimes it stops after a Windows Update and doesn't restart.

The Fix: 5 Steps to Get Back Online

Don't start reinstalling the agent yet. That's a last resort. Try these first.

Step 1: Check the Agent Service

1. Press Windows + R, type services.msc, hit Enter.
2. Look for the service name of your EDR. Common ones: CrowdStrike Falcon Sensor Service, Sentinel Agent Service, Symantec Endpoint Protection Manager.
3. Right-click it, select Properties.
4. Check the Startup type: it should say Automatic. If not, change it to Automatic.
5. If the service is stopped, click Start. If it's running, click Stop, wait 10 seconds, then Start again.
6. After you start it, wait 2 minutes. Open the EDR console. You should see the agent go from Offline to Online within 5 minutes.

Step 2: Test DNS Resolution

1. Open Command Prompt as admin. Press Windows + X, choose Terminal (Admin).
2. Type nslookup <your-EDR-cloud-server>. For CrowdStrike it's nslookup falcon.crowdstrike.com. For SentinelOne, nslookup mgmt.sentinelone.net. Check your vendor docs for the exact domain.
3. If you get Non-existent domain or a timeout, your DNS is broken. Flush DNS: type ipconfig /flushdns and hit Enter.
4. Then type ipconfig /registerdns.
5. Run nslookup again. You should see an IP address. If not, check your network adapter's DNS server (it should point to your internal DNS or 8.8.8.8 for testing).

Step 3: Check Firewall and Proxy

1. Open Windows Defender Firewall with Advanced Security. Press Windows + R, type wf.msc.
2. Click Inbound Rules. Look for rules named after your EDR (e.g., "CrowdStrike Falcon"). Make sure they're Enabled and Allow.
3. Check outbound rules too. Some security tools block outbound traffic from unknown processes. The EDR agent must be allowed out on port 443 (or the port your vendor uses).
4. If you use a proxy: open the EDR agent config file. For CrowdStrike, it's C:\ProgramData\CrowdStrike\Falcon\falcon.cfg. Look for a line like proxy_hostname and proxy_port. Make sure they're right. For SentinelOne, check C:\Program Files\SentinelOne\Sentinel Agent\config.ini.
5. If the proxy changed (like after a VPN toggle), update the config and restart the service from Step 1.

Step 4: Verify Agent Certificate

1. Open the EDR agent installation folder. For CrowdStrike, go to C:\Program Files\CrowdStrike.
2. Look for a file named cert.pem or agent.crt. Right-click it, select Properties, Digital Signatures.
3. Check if the certificate is valid (not expired). If it expires, the agent can't authenticate. You'll need to reinstall the agent with a fresh certificate from your vendor.

Step 5: Check for Conflicting Software

1. Some antivirus software blocks EDR agents. If you have a second AV (like McAfee, Norton, or Webroot), temporarily disable it.
2. Open Task Manager. Look for processes like McAfee Framework Service or Norton Security. Right-click and End task.
3. Restart the EDR service from Step 1. If the agent comes online, the other AV is the problem. Uninstall it or add an exception for the EDR folder.

Still Offline? What to Check Next

If the agent still shows offline after all this, you've got a deeper issue. Check the Windows Event Viewer. Go to Application and Services Logs > Microsoft > Windows > Security-Mitigations > Operational. Look for error codes related to the EDR. Also check the System log for disk errors. A failing hard drive can corrupt the agent files. If nothing works, contact your EDR vendor support and give them the agent log files (usually in C:\ProgramData\YourEDR\Logs).