# App allowed through elastic endpoint due to message processing error

**URL:** <https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556>\
**Category:** Endpoint Security\
**Created:** [December 24, 2020, 7:19am UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556 "2020-12-24T07:19:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [December 24, 2020, 7:19am UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/1 "2020-12-24T07:19:01Z")

</div>

Hi all.  
I have been trying to use elastic endpoint sec since yesterday and the agent on windows having some problems that i dont really know how to fix.  
It constantly say that some app or dll lib is allowed due to message processing failure, along with the error code -4.

Can some one point out how to fix this problems for me Please.  
Thanks for your time.

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 24, 2020, 7:24am UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/2 "2020-12-24T07:24:45Z")

</div>

Is there any log output you can post?

---

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [December 24, 2020, 8:39am UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/3 "2020-12-24T08:39:32Z")

</div>

Here it is:

```auto
{"@timestamp":"2020-12-24T08:27:24.7297861Z","agent":{"id":"cbe9e22f-abd6-0856-f39f-3608e6d50e49","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":631,"name":"SyncKernelMessageManager.cpp"}}},"message":"SyncKernelMessageManager.cpp:631 Process ID 7588: [C:\\Windows\\system32\\UIRibbon.dll] is allowed due to message processing failure, error code -4","process":{"pid":8152,"thread":{"id":9784}}}
{"@timestamp":"2020-12-24T08:27:24.811824Z","agent":{"id":"cbe9e22f-abd6-0856-f39f-3608e6d50e49","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":631,"name":"SyncKernelMessageManager.cpp"}}},"message":"SyncKernelMessageManager.cpp:631 Process ID 7588: [C:\\Windows\\system32\\UIRibbonRes.dll] is allowed due to message processing failure, error code -4","process":{"pid":8152,"thread":{"id":7708}}}
{"@timestamp":"2020-12-24T08:27:24.9668221Z","agent":{"id":"cbe9e22f-abd6-0856-f39f-3608e6d50e49","type":"endpoint"},"ecs":{"version":"1.5.0"},"log":{"level":"error","origin":{"file":{"line":631,"name":"SyncKernelMessageManager.cpp"}}},"message":"SyncKernelMessageManager.cpp:631 Process ID 7588: [C:\\Windows\\system32\\PhotoMetadataHandler.dll] is allowed due to message processing failure, error code -4","process":{"pid":8152,"thread":{"id":9420}}}

```

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [December 28, 2020, 2:47pm UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/4 "2020-12-28T14:47:23Z")

</div>

This is an erroneous log message we're working to remove. Endpoint is working properly.

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [December 28, 2020, 9:11pm UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/5 "2020-12-28T21:11:37Z")

</div>

I'm glad you answered this. I was wondering. I've been pondering on this and looking through Elastic issues on github to see if I could find something on this and just couldn't find anything.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 25, 2021, 9:11pm UTC](https://discuss.elastic.co/t/app-allowed-through-elastic-endpoint-due-to-message-processing-error/259556/6 "2021-01-25T21:11:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.