Hi Buddy,

Yes — we’ve run into this in DEX/Service Ops Workspace as well. In our case the service was set to run as Local System, but the warning still appeared and certain endpoint metrics stopped collecting.

What we found is that the message is a bit misleading. It’s usually not that Local System is disabled, but that the agent can’t access something it needs WMI, performance counters, or a protected metric and DEX logs it under that generic message.

Things worth checking that helped us isolate it:

• Confirm the agent service is actually running as Local System not just configured that way and was restarted after any change.

• Check for recent:

  • Windows updates

  • GPO/security baseline changes

  • EDR/AV policy updates
    These can block metric collection even for Local System.

• Review Event Viewer System + WMI Activity on affected machines.

• Validate performance counters — we had a few endpoints where corrupted counters triggered the same message.

• Compare affected vs unaffected devices OS build, patch level, agent version.

We saw a spike after a patch cycle and endpoint hardening changes, so it ended up being environmental rather than a platform defect.

You’re on the right track with the SN case — in most situations this ends up being either a WMI/counter access issue or a specific metric failing collection, not the Local System configuration itself.

@sameeramin - If help you answer, please mark Solution Accepted.