Troubleshoot event ID 771 "Contact by Unrecognized Client"

Event ID 771 Contact by Unrecognized Client appears in Workload Security if a Deep Security Agent tries to connect to Workload Security, but the computer's name doesn't exist in the list of protected computers on Computers.

Common causes include:

  • Cloned VMs or cloud instances if you haven't enabled Reactivate cloned Agents.
  • Computers deleted from Computers before deactivating Deep Security Agent, if you haven't enabled Reactivate unknown Agents. The agent software continues to try to periodically connect to Workload Security, causing the event each time until either it is uninstalled, or you reactivate the computer.
  • Interrupted sync of a connector such as AWS or Azure.

Solutions vary by the cause.

Uninstall Deep Security Agent

If you don't want to protect the unrecognized computer, you can prevent these events by deactivating or uninstalling the Deep Security Agent software. See Uninstall the Deep Security Agent.

Reactivate the computer or clone

If you want to protect the computer, activate it with Workload Security. Re-activation re-establishes the agent's certificate so that Workload Security can authenticate it with the list on Computers, and recognize the computer. See Agent-Initiated Activation.