Troubleshooting · 6 min read
Remote agent offline after a reboot: why it happens and how to fix it
Written for: Administrators responsible for unattended machines that must be reachable without anyone on site.
In short
A device that never returns after a reboot is the worst failure in unattended access, because you discover it at the moment you need the machine. The usual causes are a service set to manual rather than automatic, an agent that starts before the network is ready and gives up, a disk encryption or login prompt blocking boot, or a network that only authenticates after a user signs in. All four are preventable, and all four are found by testing the reboot deliberately.
Key takeaways
- Set the agent service to automatic with delayed start, so it launches after the network stack is up.
- A pre-boot encryption PIN or a login-gated network means the machine will never return unattended.
- Fast startup can leave the network stack in a state where the agent starts but cannot register.
- Test the reboot path per device type, not once overall — servers, laptops and kiosks fail differently.
- Monitor for devices that fail to check in after a restart rather than discovering it during an incident.
Service start type and ordering
The most common cause is mundane: the service is set to Manual, so it runs happily until the machine restarts and then never comes back. Confirm the start type is Automatic on every unattended device, and treat any that are not as a fault to fix rather than a curiosity.
Ordering matters too. A service that starts before the network adapter has an address may try once, fail to reach the broker, and stop. Automatic (Delayed Start) exists precisely for this, and it is the safer setting for anything that depends on the network at launch.
Anything that gates the boot
If the machine stops at a pre-boot screen, no service is running and nothing can reach it. Full-disk encryption with a PIN, a BIOS password, or a Windows update that waits for confirmation will all hold a machine short of a usable state indefinitely.
For genuinely unattended devices, configure encryption so it unlocks without human input via the trusted platform module, and make sure update behaviour is set to restart and complete rather than wait. A device that needs a person at the keyboard to finish booting is not an unattended device.
- Pre-boot PIN or password prompts
- Update dialogs that block at the login screen awaiting confirmation
- A recovery prompt after a firmware or hardware change
- Machines that boot into a menu after an unclean shutdown
Networks that authenticate at login
Some environments only bring the network up after a user signs in — wireless profiles stored per-user rather than per-machine, or 802.1X configured to authenticate the user rather than the machine. The device boots to the login screen with no network at all, so the agent cannot register even though everything is working as designed.
The fix is to store the wireless profile against the machine, or to configure machine authentication for 802.1X. Wired connections on unattended devices sidestep the problem entirely and are worth it for anything that must be reliably reachable.
Fast startup and unclean state
Windows fast startup does not perform a full shutdown; it hibernates the kernel session and resumes it. That usually works, but it can leave network drivers or a service in a state that a real boot would have cleared, producing a device that appears up and is not reachable.
On unattended machines, disabling fast startup makes restarts slower and considerably more predictable. Predictability is the property that matters here.
Making reboots reliable
1. Set the service to automatic delayed start
Confirm the agent service starts automatically and after the network, on every unattended device rather than a sample.
2. Remove boot-time prompts
Configure encryption to unlock without a PIN where policy allows, and set updates to complete rather than wait for input.
3. Move network authentication to the machine
Store wireless profiles per-machine, or use machine-based 802.1X, so the device has a network before anyone signs in.
4. Disable fast startup
Trade a few seconds of boot time for a clean, predictable network stack after every restart.
5. Test and then test again
Reboot a representative device of each type, confirm it returns unaided, and repeat after any major update cycle.
Frequently asked questions
- Why does the agent work until the machine restarts?
- Almost always a service start type set to Manual, or a service starting before the network is ready and giving up. Automatic (Delayed Start) addresses both.
- Can I reach a machine sitting at a BitLocker PIN prompt?
- No. Nothing is running at that point but the pre-boot environment. Unattended devices need encryption configured to unlock without human input.
- Why does the device have no network at the login screen?
- The wireless profile or 802.1X configuration is tied to the user rather than the machine, so the network only comes up after someone signs in. Move both to machine scope.
- Should I disable fast startup on unattended machines?
- Yes. It makes restarts slower but far more predictable, and it eliminates a class of intermittent post-reboot network faults.
How this works in 247connect
247connect's managed-device agent runs as a system service and re-registers on boot, so a correctly configured machine reappears in the console without anyone on site — the prerequisites above still have to be right.
More troubleshooting guides
Blocked by antivirus or endpoint protection
Why endpoint protection quarantines or blocks remote access agents, how to tell a genuine detection from a false positive, and how to allow-list a legitimate tool without weakening your defences.
Keyboard and mouse not responding
Why input stops working in a remote session while the screen still updates, covering elevation and the secure desktop, view-only mode, focus, keyboard layouts and stuck modifier keys.
No audio in a remote session
Why remote sessions have no sound, covering audio redirection settings, missing playback devices on headless machines, default device selection, muted mixers and bandwidth-driven audio suppression.