Dawnstar Labs Vardhold Docs

Troubleshooting

Most problems come down to the service, the tray app or an agent that has not restarted since install. Start with the symptom you see.

3 min readUpdated October 2026Vardhold 0.1 (pre-release)

On this page
  1. Start here
  2. Every agent action is blocked
  3. The dashboard shows a start-up warning
  4. No approval window appears
  5. Clicking Allow does not go through
  6. Claude Code or Cursor actions are not checked
  7. An MCP server shows as unprotected
  8. Events are not reaching the SIEM
  9. The integrity check fails
  10. The dashboard asks for a token
  11. Sending details to support

Start here#

From an elevated PowerShell prompt, these two commands answer most questions:

PowerShell
Get-Service Vardhold
& "C:\Program Files\Vardhold\vardhold.exe" status

Vardhold also writes warnings and errors to the Windows Application event log under the source Vardhold.

Every agent action is blocked#

If Claude Code, Cursor or an MCP server is refused everything, with a message that Vardhold could not be reached, the service is not running. This is fail-closed behaviour working as intended: no verdict means no action.

  1. Check the service: Get-Service Vardhold.
  2. Start it if it is stopped: Start-Service Vardhold.
  3. If it stops again, look in the Application event log for the reason and send it to support.

Also check that the kill switch is not engaged: vardhold status shows it, and so does a red banner on the dashboard.

The dashboard shows a start-up warning#

A banner reading Vardhold started with a problem it worked around means the service is running and protecting the machine, but something needs an administrator. For example, the policy file could not be used, so the last valid policy is in force, or a damaged database was set aside and a new one started. The banner says what happened and what to do. The same problem is in the audit log and raised as an alert.

No approval window appears#

  • Is the tray app running? Look for the Vardhold icon in the notification area, including the hidden icons. If it is missing, start Vardhold from the Start menu.
  • Check the dashboard. Pending requests are also listed under Approvals.
  • Was it too late? Unanswered approvals are blocked when their timeout runs out, 60 seconds by default.

Clicking Allow does not go through#

Allowing needs an administrator's confirmation: a UAC prompt, then the Vardhold confirmation window. On a standard user account, UAC asks for an administrator's credentials. If you cancel either window, the request stays pending, and you can still deny it.

Claude Code or Cursor actions are not checked#

  • Restart the agent. Sessions opened before installation do not load the hooks.
  • Check the agent version. The fail-closed Claude Code hook needs Claude Code 2.1.295 or later.
  • Check the install options. The MSI may have been installed with INSTALLCLAUDEHOOK=0 or INSTALLCURSORHOOK=0. Reinstall without them.
  • Look at the agent's coverage on the dashboard's Agents page, which shows whether it is checked before it runs or recorded as it happens.

An MCP server shows as unprotected#

The client's configuration no longer starts the server through Vardhold, for example after the client or a tool rewrote the file. Turn Protect on again on the MCP servers page and restart the client. A protected server that loses protection also raises a high-severity alert, so review who changed it.

Events are not reaching the SIEM#

  1. Use Send test event under Settings → Exports. The message shows what the destination answered.
  2. For Splunk, check the URL ends in /services/collector/event, the token is enabled for the index, and the certificate is trusted by Windows.
  3. For syslog over TLS, the collector's certificate must chain to a trusted root and match the host name.
  4. If you changed the Splunk URL, enter the token again: a stored token is never sent to a new address.

The integrity check fails#

vardhold verify exits with code 4, or a critical audit.integrity alert appears. Treat it as a possible incident:

  1. Do not reinstall or delete anything. Keep a copy of %ProgramData%\Vardhold.
  2. Note the message: it says which records are affected.
  3. Compare with the events your SIEM holds for the same machine.
  4. Contact support@dawnstarlabs.com.

The dashboard asks for a token#

The dashboard opened outside the tray app, so it has no session. Open it from the tray icon instead.

Sending details to support#

PowerShell
$out = "$env:USERPROFILE\Desktop\vardhold-support"
New-Item -ItemType Directory -Force $out | Out-Null
& "C:\Program Files\Vardhold\vardhold.exe" status --json > "$out\status.json"
Get-WinEvent -FilterHashtable @{ LogName = 'Application'; ProviderName = 'Vardhold'; StartTime = (Get-Date).AddDays(-2) } |
  Select-Object TimeCreated, LevelDisplayName, Message | Export-Csv "$out\events.csv" -NoTypeInformation

Review both files, then send them to support@dawnstarlabs.com. Secrets are redacted in Vardhold's own output, but read before you send.