Datto RMM Displays Datto EDR as "Not Installed" or with an Incorrect Status

Issue ID: EDR-02

Applies to: Datto EDR, Datto RMM

Environment: Windows, macOS

KB type: Troubleshooting

Overview

This article describes how to troubleshoot cases where Datto RMM reports Datto EDR as Not Installed or displays an incorrect status, even though the Datto EDR agent is installed and running on the endpoint.

How Datto RMM Determines Datto EDR Status

Datto RMM determines the Datto EDR status by checking:

• Whether the Datto EDR service (or daemon) is running.
• Whether the dattoEdr.json status file exists and contains valid, up-to-date information.
• Whether the endpoint is isolated or has an active Datto EDR policy.

If any of these checks fail, Datto RMM may display an unexpected status.

Datto RMM Statuses Values

Datto RMM determines Datto EDR agent status using the AdvancedThreatDetection (DRMM AEMAgent) module, which defines the following states:

How Datto RMM Determines Datto EDR Status

Datto RMM determines the Datto EDR status by validating the Datto EDR service (or daemon), the dattoEdr.json status file, and the endpoint's isolation and policy state.

Service/Daemon Status Checks

Datto RMM verifies that the Datto EDR service is running using the following methods:

Windows

• Checks the HUNTAgent Windows service.
• Uses a 10-second timeout for monitoring and a 30-second timeout during installation checks.

Linux

• Checks the HUNTAgent.service daemon using systemctl list-units.

• Regex:

  ^HUNTAgent.service.*running.*$

macOS

• Checks the com.datto.HUNTAgent daemon using launchctl list.

• Regex:

  ^\d+.*com.datto.HUNTAgent$

Status File Validation (dattoEdr.json)

Datto RMM also validates the Datto EDR status file.

File locations

For the status file to be considered valid:

• The file must exist.
• The file must contain valid JSON.
• The timestamp must be no more than three minutes old.

If the status file is missing but the Datto EDR service is running, Datto RMM reports the endpoint as Active using a fallback check.

State Determination Logic

The edrAgentStatus() function combines the service/daemon status with the status file validation to determine the Datto EDR state.

Troubleshooting Prerequisites

Before beginning troubleshooting, ensure you have:

• Access to the Datto RMM and Datto EDR consoles.
• Administrative access to the affected endpoint.

Supported operating systems:

• Windows
• Linux
• macOS

Troubleshooting Steps

1. Confirm the EDR Status

• Compare the status shown for the affected endpoint in both the Datto RMM and Datto EDR consoles.
• Capture screenshots or export the endpoint status for reference.

2. Check the Service or Daemon Status

Verify that the Datto EDR service or daemon is running.

• Windows: Verify the HUNTAgent service status.
• Linux: Verify the HUNTAgent.service daemon status.
• macOS: Verify the com.datto.HUNTAgent daemon status.

3. Validate the Status File

Locate the dattoEdr.json file and confirm that:

• The file exists.
• The file contains valid JSON.
• The timestamp is current.

4. Determine the Reported State

Use the state determination matrix above to interpret the service, policy, timestamp, and isolation results.

5. Check the Installation Directory

Confirm that the Datto EDR agent files exist in the expected installation directory for the endpoint operating system.

6. Check Ransomware Detection on Windows

For Windows endpoints:

• Review the ransomwareDetection flag in dattoEdr.json.
• Confirm that the RWDWrapper process is running.

Contacting Kaseya Support

If Datto RMM continues to report an incorrect Datto EDR status after completing the troubleshooting steps above, contact Kaseya Support and provide the following information:

• Datto RMM and Datto EDR logs for the affected endpoint. 
  • Datto EDR: Accessing agent log files 
  • Datto RMM: Agent log files
• A copy of the dattoEdr.json file from the affected endpoint.
  • Windows: %ProgramData%\Datto\DattoAV\dattoEdr.json
  • Linux: /var/lib/Datto/DattoAV/dattoEdr.json
  • macOS: /Library/Datto/DattoAV/dattoEdr.json

• Screenshots of the Datto EDR service or daemon state on the affected endpoint.

  • Windows: Windows Services (HUNTAgent)
  • macOS: Activity Monitor (com.datto.HUNTAgent)
• Summary of troubleshooting already completed.

Notes

• Sync Interval: The Datto RMM site/device sync interval (every 4 hours) is not relevant to EDR or Datto AV status detection in Datto RMM.
• Forced Sync: There is no option to force a sync for EDR status detection.

Related Articles

• Datto EDR + RMM Integration Documentation: Datto EDR Integration Help
• Datto RMM Release Notes: Datto RMM 13.9.0 Release Notes