# Endpoint Security not starting. "Windows can not verify the digital signature"

**URL:** <https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034>\
**Category:** Endpoint Security\
**Tags:** elastic-stack-security\
**Created:** [March 8, 2024, 12:04pm UTC](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034 "2024-03-08T12:04:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gyterpena](https://avatars.discourse-cdn.com/v4/letter/g/a9a28c/32.png) [@gyterpena](https://discuss.elastic.co/u/gyterpena)\
**Post date:** [March 8, 2024, 12:04pm UTC](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034/1 "2024-03-08T12:04:55Z")

</div>

Hello

We recently deployed elastic-agent with defend policy to windows servers and on some older ones 2012R2 we have following error. This is with agent 8.12.2

Checking status of elastic-agent.exe

```auto
PS C:\Program Files\Elastic\Agent> .\elastic-agent.exe status
┌─ fleet
│ └─ status: (HEALTHY) Connected
└─ elastic-agent
   ├─ status: (DEGRADED) 1 or more components/units in a failed state
   └─ endpoint-default
      ├─ status: (FAILED) failed install endpoint service: failed starting the command: failed to start "C:\\Program Fil
es\\Elastic\\Agent\\data\\elastic-agent-de80b0\\components\\endpoint-security.exe": fork/exec C:\Program Files\Elastic\A
gent\data\elastic-agent-de80b0\components\endpoint-security.exe: Windows cannot verify the digital signature for this fi
le. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that migh
t be malicious software from an unknown source.
      ├─ endpoint-default
      │ └─ status: (FAILED) failed install endpoint service: failed starting the command: failed to start "C:\\Program
Files\\Elastic\\Agent\\data\\elastic-agent-de80b0\\components\\endpoint-security.exe": fork/exec C:\Program Files\Elasti
c\Agent\data\elastic-agent-de80b0\components\endpoint-security.exe: Windows cannot verify the digital signature for this
 file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that m
ight be malicious software from an unknown source.
      └─ endpoint-default-aa988ac1-2a08-46f9-9cb0-3a2fc6f7c190
         └─ status: (FAILED) failed install endpoint service: failed starting the command: failed to start "C:\\Program
Files\\Elastic\\Agent\\data\\elastic-agent-de80b0\\components\\endpoint-security.exe": fork/exec C:\Program Files\Elasti
c\Agent\data\elastic-agent-de80b0\components\endpoint-security.exe: Windows cannot verify the digital signature for this
 file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that m
ight be malicious software from an unknown source.

```

Checking version of endpoint-security.exe

```auto
PS C:\Program Files\Elastic\Agent\data\elastic-agent-de80b0\components> .\endpoint-security.exe version
Program 'endpoint-security.exe' failed to run: Windows cannot verify the digital signature for this file. A recent
hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be
malicious software from an unknown sourceAt line:1 char:1
+ .\endpoint-security.exe version
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ .\endpoint-security.exe version
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
    + FullyQualifiedErrorId : NativeCommandFailed

```

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87acd0b0345405f5aaf01cfaac3b0df946cdb2c5.png)

I've seen some posts for older versions where this was fixed, and some [workarounds](https://discuss.elastic.co/t/elastic-agent-on-older-windows-disable-driver-signature-enforcement/245667) on windows that need server reboot to disable signature verification.

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [March 8, 2024, 10:24pm UTC](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034/2 "2024-03-08T22:24:18Z")

</div>

If you check the [Support Matrix](https://www.elastic.co/support/matrix) Elastic Defend 8.10.x was the last one supported on Windows Server 2012 R2

There's a pending PR to make this more obvious to the user [Update Windows Defend Support by bjmcnic · Pull Request #4201 · elastic/elastic-agent · GitHub](https://github.com/elastic/elastic-agent/pull/4201)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 5, 2024, 10:25pm UTC](https://discuss.elastic.co/t/endpoint-security-not-starting-windows-can-not-verify-the-digital-signature/355034/3 "2024-04-05T22:25:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.