Syncro Windows agent service stops after antivirus quarantine action

Issue Summary

This article covers a Syncro issue within RMM / PSA / Automation where Syncro Windows agent service stops after antivirus quarantine action. Use the path below to confirm whether the fault is policy-driven, script-driven, agent-side, tenant-side, or caused by a downstream integration.

Symptoms and Scope

• The reported problem matches the article title: Syncro Windows agent service stops after antivirus quarantine action.
• At least one affected endpoint, ticket, policy, script, alert, or customer can be compared with a known-good example.
• The issue can be tied to a recent Syncro policy change, script update, agent update, PSA workflow change, or integration change.

Tier I: Basic Checks

1. Confirm the scope: one asset, one customer, one policy, one technician workflow, or a tenant-wide Syncro issue.
2. Capture exact errors, timestamps, asset IDs, policy names, alert names, and the last known working state before changing configuration.
3. Test the simplest path first: compare a healthy endpoint, rerun the action manually, and confirm the issue is reproducible outside cached UI state.
4. Check whether the break started after a Syncro script change, policy assignment update, Windows/macOS update, antivirus action, or permission change.

Tier II: Admin Investigation

1. Review Syncro policy targeting, script history, automation results, asset details, alerting rules, and technician activity tied to Syncro.
2. Compare the failing asset or workflow against a healthy one under the same expected configuration to isolate the real difference.
3. Apply the narrowest safe fix first, such as reassigning one policy, rerunning one script, repairing one agent, or correcting one workflow condition.
4. Document whether the root cause was agent health, policy scope, permissions, script logic, monitoring conditions, or integration state.

Tier III: Advanced Remediation

1. Move to advanced remediation only after lower-tier checks are documented and reversible.
2. Validate the full chain across Syncro agent health, scripting engine behavior, remote command execution, third-party AV/RMM conflicts, and any PSA or billing integrations.
3. Reinstall the agent, rebuild automation policy links, repair system services, or refactor scripts only when evidence supports it.
4. Validate the final state from both the technician console and the endpoint or customer workflow so the fix is operationally real.

Escalation Guidance

• Escalate when the issue affects multiple customers, breaks remote management at scale, corrupts automation outcomes, or points to a vendor-side platform defect.
• Include asset IDs, tenant context, timestamps, script output, screenshots, relevant logs, and all Tier I / II / III work completed.
• State clearly whether the blocker is agent health, policy targeting, scripting, alerting, patching, remote access, or integration behavior.

Prevention and Documentation

• Document the stable fix, any script or policy changes, and any tenant-specific exceptions so future support follows the same path.
• Pilot high-impact Syncro automation and scripting changes before broad rollout.
• Keep monitoring, patching, scripting, and onboarding standards aligned so repeat issues are easier to catch early.