Windows' Services console shows that uberAgent service is not running.
When manually started, the service starts and stops after a few seconds.
uberAgent log file located in C:\Windows\Temp (default location) shows the issue with network driver startup.
Example:
2025-03-01 17:28:33.013 +0200,INFO ,DOMAIN,MACHINE$,24984,NetworkDriver,Starting driver...
2025-03-01 17:28:33.019 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Could not start driver. StartService failed with: The system cannot find the file specified.
2025-03-01 17:28:33.020 +0200,DEBUG,DOMAIN,MACHINE$,24984,NetworkDriver,Start and install...
2025-03-01 17:28:33.022 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Could not install and load driver. Finished with The system cannot find the file specified.
2025-03-01 17:28:33.022 +0200,ERROR,DOMAIN,MACHINE$,24984,NetworkDriver,Starting driver failed with: The system cannot find the file specified.
2025-03-01 17:28:33.023 +0200,INFO ,DOMAIN,MACHINE$,24984,ShutdownApp,Shutting down...
Registry value DrvFailureCount located in HKLM\SYSTEM\CurrentControlSet\Services\uberAgentNetMon is set to 3.
No data is uploaded to Splunk from the affected machine.
To re-enable uberAgent’s drivers, remove the following registry values and restart the uberAgent service:
Depending on the driver that triggered Driver Safety Net, the above registry values are located in one of the following two registry paths:
uberAgent’s drivers come with Driver Safety Net, a unique feature that prevents bluescreen loops: in the unlikely event of a crash in one of uberAgent’s drivers, the driver disables itself.
Once Driver Safety Net triggers, uberAgent’s drivers remain disabled until re-enabled