Connectivity with the Check Point Endpoint Security service is lost

[DanSO]

I encounter problems when connecting to checkpoint VPN, for the first time this problem occurred after installing an update for my operating system (I use Windows 10), after which my Checkpoint VPN stopped connecting, citing an error when deploying the client "Connectivity with the Checkpoint Endpoint Security service is lost". I should also note that I spent a lot of time searching for a solution to this problem, but none of the ways that I found on this forum worked for me. I tried to do repair for CheckpointVPN, tried to reinstall the client, and also updated it to the latest version E88.60, although I had previously tried many other available versions to solve this problem, the result was the same - an error connecting to the vpn service, which I described above, as well as the cyclical occurrence of a BSOD with completely different errors (presumably due to the fact that the windows event log is being spammed with errors "The Check Point Endpoint Security VPN service has been terminated unexpectedly. This happened 1 time(a). The next corrective action will be taken after 0 ms: Service restart." without any specifics, last time it helped to format the disk completely and install "clean" windows 10 with the old drivers (early 2023 versions), today, when I installed a new graphics(!) driver, the error began to repeat, for no apparent reason.

It is also worth noting that I checked whether the Checkpoint services were running, restarted them, and also restarted the Checkpoint network adapter in the device manager, this problem is completely unpredictable for me and I ask for help to deal with it, I will be glad of any advice.

[Chris_Atkinson]

Please contact TAC to investigate further if the existing SK articles and version upgrade have been unable to resolve this problem.

[the_rock]

For whats its worth, below is what Copilot AI gave.

Happy New Year btw 🙂

Andy

*****************************************

1. Restart the VPN Service:

   • Open the Windows Command Prompt as an Administrator and run the following commands:

     net stop TracSrvWrapper
     net start TracSrvWrapper
     

   • Alternatively, you can restart the service from the Windows Task Manager:
     • Open Task Manager.
     • Go to the "Services" tab.
     • Find "TracSrvWrapper" and restart it.

2. Check for Conflicting Applications:

   • Ensure that there are no conflicting applications installed on your machine that might interfere with the VPN service. For example, some firewall or antivirus software might cause conflicts.

3. Repair the Endpoint Security Client:

   • Go to Control Panel > Programs and Features > Uninstall or change a program.
   • Right-click on "Check Point Endpoint Security" and select "Repair".

4. Reinstall the VPN Client:

   • If the above steps do not resolve the issue, consider uninstalling and then reinstalling the Check Point Endpoint Security VPN client.
   • Make sure to remove any leftover files and registry entries before reinstalling.

5. Check System Logs:

   • Review the system logs for any error messages related to the VPN service termination. This can provide more insight into the cause of the issue.

6. Update the Client:

   • Ensure that you are using the latest version of the Check Point Endpoint Security VPN client. Sometimes, updating to the latest version can resolve known issues.

If the issue persists, please provide more details about the error message or any logs you have, and I can assist you further.

BE AWARE

Important - To prevent negative impact on your production environment, double-check the provided information in the Administration Guide for the involved product.

Learn more:

1. sk179587 - Enterprise Endpoint Security E86.60 Windows Clients
2. R82 Harmony Endpoint Server Administration Guide - Troubleshooting-the-Installation
3. sk180395 - How to change Remote Access VPN Client's default browser for SAML Authentication
4. sk173863 - Error "Check Point Endpoint Security VPN can not be installed on this computer. Check Poi...
5. sk167254 - After DNS is updated for Remote Access VPN gateway (FQDN), the client is unable to connec...
6. sk160172 - Endpoint Security VPN displays "Connection to Check Point Server lost" when using "Youku"...
7. sk182472 - "Error: Page Cannot Be Reached" unable to access multi-portal services in Captive and Gai...
8. sk92676 - Remote Access client download routes from all gateways in the Remote Access Community
9. sk179168 - Endpoint client RDP sessions or other applications disconnect after VPN re-authentication
10. sk63822 - "No such process" or "Can't bind socket: Address already in use" or "Cannot find pid of vp...

[UIBS]

Hello, thats exacly my problem but on Windows 11 Pro, build 10.0.26100.2894 .

I was able to track down the main problem, TracSrvWrapper service keeps restarting over and over again, finally crashing randomly with BSOD. I have exactly the same symptoms which DanSO described, tested on 86.50, 87.60, 87.62 and 88.60 versions. What's worse, I can replicate this problem on every single computer station in my company.

I managed to get the trac.log between the BSODs, here is it : 

SERVICE WAS STARTED
------------------------------------------

[ 5036 7096][20 Jan 9:15:56][TracService] TracSrvMainLoop: Software\CheckPoint\TRAC\5.0 exists - no need to backup
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::getDefaultPolicyValue()
[ 5036 7096][20 Jan 9:15:56][TR_OVERSITE] TrOversite::CreateConfigmanager: chose single user mode
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::create: __start__ 9:15:56.575
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::ConfigurationManager: __start__ 9:15:56.575
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::init(): __start__ 9:15:56.575
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::load(): __start__ 9:15:56.575
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadDefaultParams()
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadGwParams(): __start__ 9:15:56.577
[ 5036 7096][20 Jan 9:15:56][XmlWrapper] XmlDocument::LoadString: inside
[ 5036 7096][20 Jan 9:15:56][XmlWrapper] XmlDocument::XmlDocument: inside
[ 5036 7096][20 Jan 9:15:56][XmlWrapper] XmlDocument::Root: inside
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] Updated trac.conf.lastgood
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadGwParams(): __end__ 9:15:56.590. Total time - 13 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadPtParams(): __start__ 9:15:56.590
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadPtParams(): __end__ 9:15:56.590. Total time - 0 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadCpParms(): __start__ 9:15:56.590
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::loadCpParms(): __end__ 9:15:56.590. Total time - 0 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::load(): __end__ 9:15:56.590. Total time - 15 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::init(): __end__ 9:15:56.590. Total time - 15 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::ConfigurationManager: __end__ 9:15:56.590. Total time - 15 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] ConfigurationManager::create: __end__ 9:15:56.590. Total time - 15 milliseconds
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] langpack_filename return value LangPack1.xml, because it is Default variable. Scope: site NULL, gw NULL ,user USER
[ 5036 7096][20 Jan 9:15:56][TR_CONN_MANAGER] TrConnManager::ReadSCUIAPIMode: failed to read mode from registry
[ 5036 7096][20 Jan 9:15:56][CONFIG_MANAGER] language_index return value 0, because it is Default variable. Scope: site NULL, gw NULL ,user USER
[ 5036 7096][20 Jan 9:15:56][TR_OVERSITE] TrOversite::Create: Successfully loaded localization engine.
[ 5036 7096][20 Jan 9:15:56][MessageLoop] MessageLoop::MessageLoop::Create:
[ 5036 7096][20 Jan 9:15:56][MessageLoop] MessageLoop::MessageLoop::Create: Message Loop created
[ 5036 7096][20 Jan 9:15:56][proxy_wrapper] ProxyWrapper::Create: Starting ...
[ 5036 7096][20 Jan 9:15:56][TR_OVERSITE] TrOversite::Create: about to set proxy connections start / end CB
[ 5036 7096][20 Jan 9:15:56][proxy_authentication] ProxyWrapper::setCloseProxyConnectionFwCb: done - 14965648
[ 5036 7096][20 Jan 9:15:56][proxy_authentication] ProxyWrapper::setStartProxyConnectionFwCb: done - 14965616
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::Init: entering...
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Trying to open registry: Software\CheckPoint\TRAC
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Successfully opened key Software\CheckPoint\TRAC
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Successfully read (REG_SZ) key client_sub_type with value EndpointSecurity
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::isOfficeModeIsDisabledByUser: entering...
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::isOfficeModeIsDisabledByUser: couldn't read mode from registry
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::isOfficeModeIsDisabledByUser: OM is not disabled in registry -> return false
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::Init: Office mode is NOT disabled by user -> enable ENDPOINT_SECURITY_TYPE features
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Trying to open registry: Software\CheckPoint\TRAC
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Successfully opened key Software\CheckPoint\TRAC
[ 5036 7096][20 Jan 9:15:56][slim_utils] RaisDbGetValue: Successfully read (DWORD) key disable_ikev2 with value 1
[ 5036 7096][20 Jan 9:15:56][TR_FEATURE_MANAGER] TrFeatureManager::Init: mOfficeModeEnable=true,mSplitDnsEnable=false,mLocationAwarenessEnable=true,mAlwaysConnectEnable=true,mRoamingEnable=true,mHotspotDetectionEnable=true,mFirewallEnable=true,mScvEnable=true
[ 5036 7096][20 Jan 9:15:56][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: entering...
[ 5036 7096][20 Jan 9:15:56][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: loading library: C:\WINDOWS\system32\FirewallMonitor.dll
[ 5036 7096][20 Jan 9:15:56][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: lpFwMonitor_initLibrary returned true
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: ERROR - lpFwMonitor_Start failed, try to wait for the service initialization
[ 5036 7096][20 Jan 9:15:57][TR_UTIL] WaitForServiceStart: ("vsmon")
[ 5036 7096][20 Jan 9:15:57][TR_UTIL] WaitForServiceStart: OpenService("vsmon") failed
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] CFirewallWrapper::InitFirewallMonitor: waiting for vsmon initialization failed
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] CFirewallWrapper::FreeFirewallMonitor: entering...
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] CFirewallWrapper::FreeFirewallMonitor: calling lpFwMonitor_Stop
[ 5036 7096][20 Jan 9:15:57][TR_OVERSITE] TrOversite::Create: critical error: fail to InitFirewallMonitor, going down
[ 5036 7096][20 Jan 9:15:57][TR_OVERSITE] TrOversite::Create: Destroying TrOversite ...
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] UploadLogsComponent::Inst: create UploadLogsComponent instance
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] UploadLogsComponent::FlushBufferToFile: entering
[ 5036 7096][20 Jan 9:15:57][TR_FIREWALL] UploadLogsComponent::FlushBufferToFile: m_logConf is NULL
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::destroy: __start__ 9:15:57.8
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::destroy: delete mInst
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::~ConfigurationManager: __start__ 9:15:57.8
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::saveToFile()
[ 5036 7096][20 Jan 9:15:57][XmlWrapper] XmlDocument::XmlDocument: inside
[ 5036 7096][20 Jan 9:15:57][XmlWrapper] XmlDocument::SaveString: inside
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] OBSCURE_FILE return value 1, because it is Default variable. Scope: site NULL, gw NULL ,user USER
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] Updated trac.conf.bak
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] Updated trac.conf
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::~ConfigurationManager: __end__ 9:15:57.10. Total time - 2 milliseconds
[ 5036 7096][20 Jan 9:15:57][CONFIG_MANAGER] ConfigurationManager::destroy: __end__ 9:15:57.10. Total time - 2 milliseconds
[ 5036 7096][20 Jan 9:15:57][TR_EP_DAF_CLIENT] TrEpDAFClient::Destroy: Was not loaded.
[ 5036 7096][20 Jan 9:15:57][TR_SRV2CL] TrSrv2Cl::Destroy: Entering...
[ 5036 7096][20 Jan 9:15:57][TR_SCVCOMPLIANCEENG] TrScvComplianceEng::Destroy: inside
[ 5036 7096][20 Jan 9:15:57][TR_OVERSITE] TrOversite::ReleaseSrvMutex: mutex successfully released
[ 5036 7096][20 Jan 9:15:57][Object_validator] Object_validator::clear: enter...
[ 5036 7096][20 Jan 9:15:57][TracService] TracSrvMainLoop:
------------------------------------------
SERVICE WAS STOPPED

Please help, situation is critical because we lost contact to our mayor customers and we cant provide any service atm.

[PhoneBoy]

This will require TAC to investigate: https://help.checkpoint.com. 

[Ungolko]

Any solution for this? Fist i had it on my laptop, then the same start happening on PC. Have no idea what to do. Should i wait for the new client?