Syncro agent shows online but scripts never return output

Field Summary

A Syncro asset can look online while scripts return no output because heartbeat and script execution are separate paths. Work the problem from asset identity, policy scope, script history, agent service state, execution context, and endpoint security blocks before reinstalling the agent.

Common Symptoms

• Asset status is online but scripts stay pending or complete with blank output.
• Remote access may work while scripts fail.
• Only one customer, policy, script, or endpoint group is affected.
• The issue starts after an agent update, AV/EDR change, policy move, or duplicate asset cleanup.

Fast Triage

1. Confirm customer/site, asset name, serial, and policy assignment.
2. Run a tiny test script such as hostname, whoami, or echo test.
3. Check script history for queued, started, timeout, blank, or failed state.
4. Check the Syncro agent service on the endpoint if remote shell or another tool is available.
5. Look for antivirus quarantine or PowerShell/script blocking events.
6. Compare against another endpoint in the same Syncro policy.

Likely Causes

• Agent service partially hung despite heartbeat.
• Script runs in a context that lacks permissions or expected variables.
• Policy does not actually apply to that asset.
• AV/EDR blocks PowerShell, temp execution, or agent components.
• Duplicate asset or wrong customer/site association receives the command.
• Syncro command queue or backend delay.

Tier 1 Fix Path

1. Refresh the asset and confirm last check-in time.
2. Run a minimal script and record output behavior.
3. Restart the Syncro agent service if safe and locally justified.
4. Do not reinstall until policy, service state, script context, and security blocks have been checked.

Tier 2 / Admin Investigation

1. Review Syncro script history, activity log, policy assignment, variables, and customer/site mapping.
2. Inspect endpoint service state and local agent logs where available.
3. Check AV/EDR events for blocked script runner, PowerShell, batch, temp path, or agent binary.
4. Run the same script against a working asset in the same policy.
5. Check for duplicate assets and stale records before agent repair.

Advanced Remediation

Repair or reinstall the agent only when service/log evidence points to local agent damage. Preserve asset identity during reinstall so history, billing, and policy assignment do not split across duplicates.

Verification

• Tiny test script returns visible output.
• Original script returns expected output.
• Activity log shows clean execution with current timestamp.
• Asset remains in the correct customer/site/policy after refresh.

Ticket Notes to Capture

• Asset ID, customer/site, policy, script name, run ID/time, output state, agent service state, AV/EDR findings, duplicate asset check, action taken, verification.

Escalate When

• Multiple assets in one tenant stop returning script output.
• Syncro queue or platform delay is suspected.
• Security tooling blocks agent/script execution and needs policy approval.
• Agent reinstall creates duplicate or orphaned assets.

Prevention

Keep a standard Syncro health script that reports identity, execution context, policy variables, and output return. Document AV exclusions and agent reinstall steps per client.