> Source: [sk181176](https://support.checkpoint.com/results/sk/sk181176)

# sk181176 - Freshly installed Endpoint Client shows as disconnected from the Server after an Endpoint Server upgrade

| Property | Value |
|----------|-------|
| Solution ID | sk181176 |
| Date Created | 2023-06-28 |
| Last Modified | 2023-07-03 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Windows |

## Symptoms

- * After the Endpoint Server upgrade, freshly installed client has the Disconnected status in GUI, while all the existing clients remain connected to the Server.
* According to the *cpda.log* file, the Endpoint client is disconnected but HTTP response is "*Code 200*" which means there is connectivity to the Server.
* The *cpda.log* file has these messages:   
  `
  [error] DSM returned failure when policyDelivery was called [CDSM::policyDelivery]`  
  `
  [error] Failed to deliver policy err=70001 [CDAProtocol::handleSyncRespForModule]`  

  The *idafserver.log* file has these entries:  

  `[error] CryptAcquireContext failed. can't create csp`  
  ` [PolicyStorageUtils::GetProtectedSymmetricKey]`  
  `
  [error] GetProtectedSymmetricKey failed. can't use key. [PolicyStorageUtils::EncryptData]`  
  `
  [error] Can't encrypt file. Exiting E_FAIL [CPolicyStorageModule::StorePolicy]`  
  `
  `  
  `
  Failed to send payload synchronously message (or problem with response) `  
  `[CDAProtocol::sendClientPayloadSynchronously]`  
  `
  [error] SendBladeMessage: Failed to send ClientPayloadSynchronious `  
  `[CDSM::sendBladeMessageToServersInSL]`  
  `
  [error] SendBladeMessage: Failed to send blade message, type: GET_TOKEN, returning hr: 0x80004005 `  
  `[CDSM::sendBladeMessage]`

## Cause

The root cause of the issue lies in a corrupted crypto container utilized for policy encryption.  

Windows documentation *about RSA .* The location is*C:\\ProgramData\\Microsoft\\Crypto\\RSA\\* folder.  
The *MachineKeys* folder stores certificate pair keys for both the computer and users. Both Certificate services and Internet Explorer use this folder.  

*about key container:*   

A part of the Key Data Base that contains all the key pairs (exchange and signature key pairs) belongs to a specific user. Each container has a unique name that is used when calling the *CryptAcquireContext* function to get a handle to the container.  

Also, other crypto-related application can cause the issue, for example, in *msinfo* in Start \> Menu \> Programs \> "RSA SecurID Token" or "RSA" .

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get assistance.

For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member involved in the case.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content