The UI shows all Endpoint Agents with off-line status. Attempts to start the "RSA ECAT Server" fail. \Program Files\RSA\ECAT\Server\ConsoleServer-Error.log displays message "Invalid License or missing License" The License file is in the \Program Files\RSA\ECAT\Server folder.
The License is based on the CID number (Computer Identification hash based on machine). The CID will change if the NW Endpoint is installed on a different physical machine, or if the Virtual Machine has been moved or rebuilt.
To verify this is the case, check the UI -> About -> About RSA NetWitness Endpoint panel. Scroll down to the section with the line "LicenseComputerID=xxxxxxxxx" and "LicenseExpirationDate= M/DD/YYYY" Take note of the LicenseSerialNumber (this will be used to fill out a case with the RSA Business Operations Group).
If the present date match's the expiration date, contact your sales rep to get the license renewed. Next, verify the ComputerID number by opening a command prompt, change folders to <Drive>:\Program Files\RSA\ECAT\Server, type ConsoleServer.exe /cid. You will see a pop-up box, click "I agree" and at the bottom of the box, you will find the Computer ID. Compare that to the one in the about panel. If they are different, this means that the hardware platform has changed, and you will need to get a new license.