Troubleshoot event ID 771 Contact by Unrecognized Client

Event ID 771 Contact by Unrecognized Client appears in Workload Security if an agent tries to connect to Workload Security but the computer's name does not exist in the list of protected computers on Computers.

Common causes include:

• Cloned VMs or cloud instances if you have not enabled Reactivate cloned Agents.
• Computers deleted from Computers before deactivating the agent, if you have not enabled Reactivate unknown Agents. The agent software continues to try to periodically connect to Workload Security, causing the event each time until either it is uninstalled, or you reactivate the computer.
• Interrupted synchronization of a connector, such as AWS or Azure.

Solutions vary by the cause.

Uninstall the agent

If you do not want to protect the unrecognized computer, you can prevent these events by deactivating or uninstalling the agent software. See Uninstall the agent.

Reactivate the computer or clone

If you want to protect the computer, activate it with Workload Security. Reactivation re-establishes the agent's certificate so that Workload Security can authenticate it with the list on Computers, and recognize the computer. See Agent-Initiated Activation.