# Error during agent enrollment **URL:** \ **Category:** Elastic Agent\ **Tags:** elastic-stack-monitoring\ **Created:** [December 25, 2025, 1:03pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246 "2025-12-25T13:03:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Viktor\_Movita](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/viktor_movita/32/135707_2.png) [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Post date:** [December 25, 2025, 1:03pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246/1 "2025-12-25T13:03:47Z")
Hello everyone, I am trying to install Elastic Agent version 8.16.2 on Windows servers. On some servers the installation succeeds, but on others it fails with the error: `failed to create new agent info: could not get agent info from store: failed to load from ioStore: failed to ensure key during encrypted disk store Load: could not get agent key: Key not valid for use in specific state.` Does anyone recognize this issue and found a solution? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 25, 2025, 9:18pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246/2 "2025-12-25T21:18:21Z")
Hi @Viktor_Movita So there is always the question of what is different about the servers that are failing? Different Security Setup? Permissions etc... Also, there were some potential related issues, perhaps update to 8.17 > > > \## What does this PR do? > > This PR fixes a bug in the \`FleetGateway.execute\` me…thod where a call to \`info.Metadata\` could return an error that was not being propagated. If this error occurred during shutdown (e.g. due to context is done/cancelled), the subsequent logic would attempt to use \`nil\` values, resulting in a panic. > > The fix ensures that the \`execute\` function returns early if \`info.Metadata\` fails, avoiding a \`nil\` dereference and the resulting crash. > > \## Why is it important? > > This bug was causing panics during agent shutdown, as reported in \[issue #7309\](https://github.com/elastic/elastic-agent/issues/7309). The error originated from the failure to load agent metadata, which led to a \`SIGSEGV\` (segmentation fault) because the error was logged but not returned. This led to \`nil\` being used downstream, triggering a crash. > > Fixing this ensures more graceful shutdown behaviour and prevents unexpected restarts of the Elastic Agent under these failure conditions. > > \## Checklist > > > > \- \[\] I have read and understood the \[pull request guidelines\](https://github.com/elastic/elastic-agent/blob/main/CONTRIBUTING.md#pull-request-guidelines) of this project. > \- \[\] My code follows the style guidelines of this project > \- \[\] I have commented my code, particularly in hard-to-understand areas > \- \[\] I have made corresponding changes to the documentation > \- \[\] I have made corresponding change to the default configuration files > \- \[\] I have added tests that prove my fix is effective or that my feature works > \- \[\] I have added an entry in \`./changelog/fragments\` using the \[changelog tool\](https://github.com/elastic/elastic-agent#changelog) > \- \[\] I have added an integration test or an E2E test > > \## Disruptive User Impact > > > > No disruptive impact expected. The change improves error handling during shutdown, preventing panics and unnecessary agent restarts. It does not alter runtime behaviour under normal conditions. > > \## How to test this PR locally > > > > Deploy a k8s agent pod and delete the pod, observe that it no longer panics with this reason > > \## Related issues > > > \- Closes https://github.com/elastic/elastic-agent/issues/7309 > > > On Windows with an installed Elastic Agent that is enrolled into Fleet is unable… to re-enroll. Performing enroll results in the following error: > > \`\`\` > C:\\Program Files\\Elastic\\Agent\>.\\elastic-agent.exe enroll --url={url} --enrollment-token={token} > Error: the command is executed as root but the program files are not owned by the root user. > For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html > \`\`\` > > For confirmed bugs, please report: > \- Version: 8.17.3+ > \- Operating System: Windows > \- Steps to Reproduce: > > 1. Install \`elastic-agent.exe\` on Windows (not in unprivileged mode). > 2. Go into that directory and then run \`.\\elastic-agent.exe enroll\` and see that it fails with the following error: > > \`\`\` > C:\\Program Files\\Elastic\\Agent\>.\\elastic-agent.exe enroll --url={url} --enrollment-token={token} > Error: the command is executed as root but the program files are not owned by the root user. > For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.17/fleet-troubleshooting.html > \`\`\` And I always suggest reviewing > **[Common problems with Fleet and Elastic Agent | Elastic Docs](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems)** > > We have collected the most common known problems and listed them here. If your problem is not described here, review the open issues in the following... ---
**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Post date:** [January 9, 2026, 3:15pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246/3 "2026-01-09T15:15:32Z")
Hello @Viktor_Movita I had seen a similar error and the issue was that the host was unable to connect to the fleet server, which turned out to be a connectivity problem: ```auto failed to create new agent info: could not get agent info from store: failed to load from ioStore: failed to ensure key during encrypted disk store Load ``` Could you please confirm if you experienced the same situation? This would help others troubleshoot more effectively in the future. Thanks!!