PSU and SentinelOne
I just wanted to let you know we have issues with PSU and SentinelOne (security platform) on 2026.2.4
Issues started when introducing a continouos schedule workflow (every 10 minutes)
After a few hours the PSU service stopped every time, and we also saw Sentinelctl.exe crashes in eventlog just before the timestamp.
We tried excluding PSU in SentinelOne but that didn't work.
Problem was resolved when completely uninstalling SentinelOne.
So I think we can conclude it was indeed related.
All Comments (1)
Hello @denistiri
Thank you for reporting this and for including the correlation you observed between the PSU service stopping and the Sentinelctl.exe crashes.
The fact that the behavior stopped after SentinelOne was removed is significant, but before concluding that SentinelOne is directly causing the PSU service termination, I would like to narrow down the interaction.
Could you please provide the following?
• Windows version and how PSU 2026.2.4 is hosted (Windows Service, IIS, ZIP, etc.).
• SentinelOne Agent version/build.
• Whether Windows Event Viewer reports PowerShellUniversal.exe or the PSU service as crashed, terminated unexpectedly, or simply stopped.
• Sanitized Event Viewer details for the PSU and Sentinelctl.exe events, including timestamps, Event IDs, faulting module, and exception code when available.
• Sanitized PSU logs covering approximately five minutes before and after one occurrence.
• Whether the workflow normally completes within the 10-minute schedule interval or whether executions can overlap.
One additional test would be particularly useful: with SentinelOne installed, disable only this 10-minute workflow schedule and leave the environment running for approximately the same period in which the failure normally occurs. This would help determine whether the behavior requires the scheduled workflow or occurs with PSU and SentinelOne generally.
Because this is a public forum, please sanitize all evidence before posting. Remove credentials, tokens, license keys, cookies, private keys, full connection strings, email addresses, usernames, customer data, tenant or account identifiers, internal domains, hostnames, IP addresses, and private URLs. Please do not upload unredacted HAR files, memory dumps, database backups, or complete configuration files to this public thread.
Best regards,
Ruben Tapia