Troubleshooting

Start here#

From an elevated PowerShell prompt, these two commands answer most questions:

Get-Service Vardhold
& "C:\Program Files\Vardhold\vardhold.exe" status

Vardhold also writes warnings and errors to the Windows Application event log under the source Vardhold.

Get a blocked machine working again#

If agents are blocked and should not be, work down this list. Most problems stop at the first or second step. Run each command from an elevated PowerShell prompt opened by a person.

1. Start the service if it is stopped: Start-Service Vardhold.
2. Release the kill switch if it is engaged: vardhold killswitch release.
3. Stop blocking, keep recording: vardhold mode monitor. It takes effect at once for every agent, and in monitor mode the hooks let actions through even if the service then stops. Switch back with vardhold mode enforce once the cause is fixed.
4. Fix the rule. The timeline shows which rule blocked an action. Narrow it, or restore an earlier policy version from the policy history.
5. Take the hooks out of the way only if the service cannot be started: vardhold-hook uninstall --managed (Claude Code) and vardhold-hook uninstall --cursor. Agents then run unchecked, so put them back with install as soon as the service is healthy.
6. Uninstall from Settings → Apps or your management tool.

Every agent action is blocked#

If Claude Code, Cursor or an MCP server is refused everything, with a message that Vardhold could not be reached, the service is not running. This is fail-closed behaviour working as intended: no verdict means no action.

1. Check the service: Get-Service Vardhold.
2. Start it if it is stopped: Start-Service Vardhold.
3. If it stops again, look in the Application event log for the reason and send it to support.

Also check that the kill switch is not engaged: vardhold status shows it, and so does a red banner on the dashboard.

The dashboard shows a start-up warning#

A banner reading Vardhold started with a problem it worked around means the service is running and protecting the machine, but something needs an administrator. For example, the policy file could not be used, so the last valid policy is in force, or a damaged database was set aside and a new one started. The banner says what happened and what to do. The same problem is in the audit log and raised as an alert.

No approval window appears#

• Is the tray app running? Look for the Vardhold icon in the notification area, including the hidden icons. If it is missing, start Vardhold from the Start menu.
• Check the dashboard. Pending requests are also listed under Approvals.
• Was it too late? Unanswered approvals are blocked when their timeout runs out, 60 seconds by default.

Clicking Allow does not go through#

Allowing needs an administrator's confirmation: a UAC prompt, then the Vardhold confirmation window. On a standard user account, UAC asks for an administrator's credentials. If you cancel either window, the request stays pending, and you can still deny it.

Claude Code or Cursor actions are not checked#

• Restart the agent. Sessions opened before installation do not load the hooks.
• Check the agent version. The fail-closed Claude Code hook needs Claude Code 2.1.295 or later.
• Check the install options. The MSI may have been installed with INSTALLCLAUDEHOOK=0 or INSTALLCURSORHOOK=0. Reinstall without them.
• Look at the agent's coverage on the dashboard's Agents page, which shows whether it is checked before it runs or recorded as it happens.

An MCP server shows as unprotected#

The client's configuration no longer starts the server through Vardhold, for example after the client or a tool rewrote the file. Turn Protect on again on the MCP servers page and restart the client. A protected server that loses protection also raises a high-severity alert, so review who changed it.

Events are not reaching the SIEM#

1. Use Send test event under Settings → Exports. The message shows what the destination answered.
2. For Splunk, check the URL ends in /services/collector/event, the token is enabled for the index, and the certificate is trusted by Windows.
3. For syslog over TLS, the collector's certificate must chain to a trusted root and match the host name.
4. If you changed the Splunk URL, enter the token again: a stored token is never sent to a new address.

The integrity check fails#

vardhold verify exits with code 4, or a critical audit.integrity alert appears. Treat it as a possible incident:

1. Do not reinstall or delete anything. Keep a copy of %ProgramData%\Vardhold.
2. Note the message: it says which records are affected.
3. Compare with the events your SIEM holds for the same machine.
4. Contact [email protected].

The dashboard asks for a token#

The dashboard opened outside the tray app, so it has no session. Open it from the tray icon instead.

Sending details to support#

$out = "$env:USERPROFILE\Desktop\vardhold-support"
New-Item -ItemType Directory -Force $out | Out-Null
& "C:\Program Files\Vardhold\vardhold.exe" status --json > "$out\status.json"
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'Vardhold'; StartTime = (Get-Date).AddDays(-2) } |
  Select-Object TimeCreated, LevelDisplayName, Message | Export-Csv "$out\events.csv" -NoTypeInformation

Review both files, then send them to [email protected]. Secrets are redacted in Vardhold's own output, but read before you send.