# Endpoint capability restriction error **URL:** \ **Category:** Endpoint Security\ **Tags:** fleet\ **Created:** [August 16, 2021, 9:53pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610 "2021-08-16T21:53:52Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Post date:** [August 16, 2021, 9:53pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/1 "2021-08-16T21:53:52Z")
We are on a 7.14 stack with 7.14 agent running. I'm seeing an error below which I've never seen before. It causes the Agent state to be `degraded`. I'm a bit unclear on the `capability restriction 'I deny(*)` portion of the error. Does anyone know what may cause this? ```auto 12:33:48.568 elastic_agent [elastic_agent][info] Elastic Agent status changed to: 'online' 12:33:48.568 elastic_agent [elastic_agent][info] input 'endpoint' is not run due to capability restriction 'I deny(*)' 12:33:48.568 elastic_agent [elastic_agent][warn] Elastic Agent status changed to: 'degraded' 12:33:48.573 elastic_agent [elastic_agent][info] New State ID is T4yUJqBY ``` ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 17, 2021, 6:27am UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/2 "2021-08-17T06:27:03Z")
Have you modified the capabilities.yml file? can you share the content of it? ---
**Author:** ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Post date:** [August 17, 2021, 2:39pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/3 "2021-08-17T14:39:22Z")
@ruflin not to my knowledge, I was unaware of such file. Where exactly is it located? I'm not seeing it in the Agent directory. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 18, 2021, 9:14am UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/4 "2021-08-18T09:14:11Z")
Hm, if there is no file you should have all the capabilities. - What OS are you on? - How did you install the Elastic Agent? ---
**Author:** ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Post date:** [August 18, 2021, 4:38pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/5 "2021-08-18T16:38:25Z")
@ruflin We are on Win10 64bit. But we are using the `run` command as opposed to the the `install` command for the agent. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [August 20, 2021, 6:52am UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/6 "2021-08-20T06:52:27Z")
@blaker @Kevin_Logan Any idea what could cause this? ---
**Author:** ![blaker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blaker/32/65621_2.png) [@blaker](https://discuss.elastic.co/u/blaker)\ **Post date:** [August 20, 2021, 1:10pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/7 "2021-08-20T13:10:32Z")
Default capabilities does not include this, so a `capabilities.yml` would need to be present for that type of message to appear. I would check the `C:\Program Files\Elastic\Agent` directory as well as the `C:\Program Files\Elastic\Agent\data\elastic-agent-${version}` directory to see if a `capabilities.yml` is present. ---
**Author:** ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Post date:** [August 20, 2021, 7:17pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/8 "2021-08-20T19:17:01Z")
There is no `capabilities` file present in either directory. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/e/ceb47d26bf0f68e40c4e03ae3944ad980c1ec55a.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/0836ae4446e1cf8d5988c49d19a7949bba7497b8.png) ---
**Author:** ![bm11100](https://avatars.discourse-cdn.com/v4/letter/b/b3f665/32.png) [@bm11100](https://discuss.elastic.co/u/bm11100)\ **Post date:** [August 25, 2021, 2:34pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/9 "2021-08-25T14:34:42Z")
Figured it out, ended up being something pretty simple. The Endpoint integration ended up being added to the Fleet server policy instead of the Agent policy. Just had to remove the integration from fleet server and it went healthy ---
**Author:** ![blaker](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blaker/32/65621_2.png) [@blaker](https://discuss.elastic.co/u/blaker)\ **Post date:** [August 30, 2021, 3:41pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/10 "2021-08-30T15:41:22Z")
Glad you figured it out. Yes that would be why that capability was denied, because that policy will not allow that integration. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 27, 2021, 3:41pm UTC](https://discuss.elastic.co/t/endpoint-capability-restriction-error/281610/11 "2021-09-27T15:41:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.