Client is failing to execute the Host Integrity check
Article ID: 158890
Updated On:
Products
Issue/Introduction
The Endpoint Protection (SEP) client is failing to execute the Host Integrity check.
The SEP client Security Logs contain the following error :
Event: Host Integrity Failed
Description: Fail to execute Host Integrity check
Data: Error Type: 0x00400020, Error Code: 0x00000000
Cause
HI requires Windows Script Host along with associated script extensions to be enabled and associated in order to function properly. If disabled or incorrectly associated HI will fail.
1. Verify Windows Script Host status on the affected machine.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
DWORD "Enabled" value of "0" is DISABLED, "1" is ENABLE
2. Then verify script extension
The .JS file extension may have been taken over by a different application in the Windows registry, such as a text editor.
By default the "HKEY_CLASSES_ROOT\.js" registry key should have a default value of "JSFile". If this has been changed, the Windows Scripting Host may be unable to find the ScriptEngine subkey, which leads to a failure when Host Integrity attempts to launch the script.
The same error can also occur if the value under "HKEY_CLASSES_ROOT\.js" is correct, but the "HKEY_CLASSES_ROOT\JSFile\ScriptEngine" is missing the default value of "JScript".
Resolution
I) To enable Windows Script Host
1. Change "Enabled" DWORD to '1' in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
2. Run smc -stop / smc -start
II) To re-associate .js script extension
Importing the following snippet as a .reg file:
-------------------------------------------------------------------------------- REGEDIT4 [HKEY_CLASSES_ROOT\.js] @="JSFile" [HKEY_CLASSES_ROOT\JSFile\ScriptEngine] @="JScript" --------------------------------------------------------------------------------
III) If the above Registry settings are correct for the .JS extension, add an exclusion for "C:\Windows\System32\cscript.exe" from the SEPM in the exception policy and verify the HI check passes successfully :
Also see possible related issue when Endpoint Protection fails to execute Host Integrity check even though cscript.exe runs
Feedback
