WinCollect: Unable to start the WinCollect process due to key corruption

Resolving The Problem

1. Log in as an Administrator to the Windows server where the WinCollect agent is installed.
2. Open PowerShell.
3. Run the following command to find the key for WinCollect.
   Notes:
   • Most of the content of these files is not in plain text.
   • The keys are located in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\.
   • The key for the WinCollect agent contains the string WinCollect.ConfigServerConnection.
   • If you are not able to see or open the key, then the problem with the WinCollect agent could be the permissions for the key.
    

   Select-String -Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*" -Pattern "WinCollect"

   Output example:
   In the following capture, the key is the one starting with 6c6416ddf7:
   
4. Delete the key that contains the string WinCollect.ConfigServerConnection in it, you can also move it outside the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\ directory.
5. Uninstall the WinCollect agent.

6. Verify that the following folders are deleted, if not, go ahead and delete them manually:

   C:\Program Files\IBM\WinCollect
   C:\ProgramData\WinCollect

7. Reinstall the WinCollect agent.
   
   Result:
   The WinCollect agent service is able to start without any error. If the issue persists, contact QRadar Support for assistance.