> For the complete documentation index, see [llms.txt](https://docs.cloudcyte.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudcyte.com/troubleshooting/the-agent-troubleshooting/troubleshooting-the-windows-agent.md).

# Troubleshooting the Windows Agent

## Checking the Agent:

Once the agent is installed, two services are installed:

* PMService: This service performs updates for the agent.
* ICSFAgentService: This service executes all agent functions. When this service is restarted, the agent re-initiates artifact collection policies and registers itself to the server.

The below files and folders can be used for Troubleshooting:

* C:\Program Files\ICSFAgentService\logs\\<>.txt: This is the main file used by the agent to write any exception.
* C:\Program Files\ICSFAgentService\logs\\\<folder>: Every module and major artifact collector of the agent creates separate log files, which could be needed for Troubleshooting.
* C:\Program Files\ICSFAgentService\debug.txt: When set to true and the ICSFAgentService is restarted, more detailed logging is enabled.
* C:\Program Files\ICSFAgentService\ICSFAgentService.url.txt: The main URL agent-server communicates is written here if it needs to be checked for Troubleshooting.
* C:\Program Files\ICSFAgentService\files\collector\\\<Collector Name>\_\<Logs/Results/Settings>.txt: Every artifact collection type creates three files under this folder. The settings, log and the last result are available for Troubleshooting.
* C:\ProgramData\ICSFAgentService\PolicyExecutionTime.json: When LastExecutionTime set to "", the collection can be initiated instantly.
* C:\ProgramData\ICSFAgentService\Event Logs Collections: Security logs to be sent to server is stored in this folder.
* C:\ProgramData\ICSFAgentService\Sysmon Logs Collections: Sysmon logs to the server are stored in this folder.
* C:\ProgramData\ICSFAgent\Thor\ThorPolicyExecutionTime.json: When LastExecutionTime is set to "", Thor collections can be started immediately.
* C:\ProgramData\ICSFAgent\Sysmon Settings: Sysmon settings are stored in this folder.
* C:\ProgramData\ICSFPackageManager: Software deployments are managed through this folder.
* C:\ProgramData\PMService: Package manager settings are stored in this folder. The file is encrypted.

Also, please check the machine and server communication with ping, curl, or other tools.

## Checking the Portal:

Please check the Windows policies, the rules should be assigned below by default. The users can customize the policy rules according to their requirements.

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FEq7hcqAfvZiEZoKSc3Ii%2Fimage.png?alt=media&amp;token=073b6ef8-222c-4702-8f62-5c4401de5de7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FcTaGm5ROMWV70WObIZc6%2Fimage.png?alt=media&amp;token=df472683-bfa6-4a35-b5eb-a733d1ce20d4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1723175359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LuHp6M9xm4Gdg2pWusc%2Fuploads%2FJhOEBzfLr0tjsoG3XETI%2Fimage.png?alt=media&amp;token=dcf535fe-70d6-4785-97c5-4a2fd38cabb4" alt=""><figcaption></figcaption></figure>

## Uninstalling the Agent:

There are two ways to delete the agent and package manager.

1. Delete the agent with the parameter:

   On the cmd please run the agent with `--uninstall --silent` parameter.
2. The below script can be used to uninstall all components manually.

{% file src="/files/410527h1KvAkPFp2lBxU" %}