[Prisma Cloud Compute Edition]Prisma Defender on Windows VM being stopped on every reboot and needs to be started manually
Symptom
-
You have Prisma Cloud Host/Container Defender installed on a Windows VM.
When the VM is rebooted, the Defender service does not start automatically, even though the Twistlock Defender service is set to "Automatic".To investigate, you can check the Windows system logs:
- Go to your Windows Search bar, type "Event Viewer", and press Enter.
- In the Event Viewer application, expand Windows Logs and navigate to the System logs.
- Search for entries related to "Twistlock".
-
In the logs, you will likely encounter the following error:
A timeout was reached (30000 milliseconds) while waiting for the twistlockDefender service to connect.
Environment
- Prisma Cloud Compute Edition
- Prisma Cloud Enterprise Edition
- Windows VM
- Windows Defender
Cause
The error message "A timeout was reached (30000 milliseconds) while waiting for the TwistlockDefender service to connect" usually occur when a service on Windows fails to start within the expected time frame.
Windows services are background processes that are started, stopped, or restarted either automatically or manually. This error indicates that Windows was waiting for a service to start, but it took longer than expected, leading to a timeout.
Resolution
-
Search for "Twistlock Defender" in your Windows running services.
- Open the Services app by typing
services.mscin the Start menu or Run dialog.
- Open the Services app by typing
-
Right-click on the "Twistlock Defender" service and select "Properties".
- In the General tab, set the Startup type to "Automatic (Delayed Start)".
-
Click Apply and then OK to save the changes.
This should resolve the issue. Upon the next reboot, the service will start automatically with a slight delay.