Has anyone seen ConnectWise Automate disappear on Windows 11 25H2? The issue does not occur on older Windows 11 releases or Windows 10. After the agent has been installed for a few days, the executable files in C:WindowsLTSVC are gone, while most other files remain. The associated services also disappear from Services, so the agent has to be reinstalled.
Neither the antivirus nor the EDR reports detections for the missing executables. I also excluded C:WindowsLTSVC from both products and created a Group Policy exclusion for Microsoft Defender, but the files still vanish. I'm trying to determine whether this is caused by the Automate agent's update or repair process, Windows 11 25H2, or something else.
3 Answers
Were these machines clean installations of Windows 11 25H2, or were they upgraded from 24H2? Feature updates can affect software installed under system directories, and that distinction could help determine whether this is specific to the 25H2 build or related to the upgrade process.
I’d enable auditing on C:WindowsLTSVC and add a SACL for file deletion. Security event 4663 may identify the process and account responsible, which should tell you whether this is security software, Windows maintenance, or the Automate agent itself. I’d also check LTErrors.txt immediately before the failure in case the agent is trying to update or repair itself.
Event ID 11724 in the Application log is worth investigating. That usually points toward a Windows Installer product being removed, so the agent may be uninstalling itself rather than simply losing files to antivirus. Check the event details for the product name, uninstall context, and timestamps, then compare them with the time the services disappear.
There’s nothing unusual in LTErrors.txt so far, but I’m going to enable auditing on the directory and see whether it catches the process removing the files.