ZCC Upgrade Loop After Restart: Log Line That Names the Broken Module

Zscaler · Techclick CLI troubleshooting lab

After a forced ZCC upgrade, the laptop reboots into another upgrade. User cannot stay on the network.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Zscaler for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Read ZSAUpm / ZCC logs for the module that fails hash or service start. Roll back that module or repair the service, do not keep pushing the same package.

Why this ticket shows up

ZCC is several services. An updater that cannot replace a locked driver will reboot and try again forever.

Symptoms operators actually see

• Upgrade prompt after every login

• ZSAService crash in Event Viewer

• Only one laptop image fails

• Endpoint protection locks the driver

CLI first — copy this block

Run these on the Zscaler device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

sc query ZSAService
sc query ZSATunnel
sc query ZSAUpm
powershell -c "Get-WinEvent -LogName Application -MaxEvents 50 | Where-Object {$_.ProviderName -match 'Zscaler'} | Format-List TimeCreated,Id,Message"
dir %ProgramData%\Zscaler\Install

How to read that output

A service that is STOPPED after reboot is the module to repair. If CrowdStrike or Defender lock a .sys file, the updater will loop.

Triage order

1. List Zscaler services and their state.

2. Read the last installer log in ProgramData.

3. Exclude the ZCC driver path in the EDR if it is locking files.

4. Install the same version as a repair, or roll back one build.

5. Only then retry the upgrade.

Classic traps

What you see	Real cause	Fix
Push the upgrade again	EDR locks the driver	Add an exclusion
Delete the whole Zscaler folder	You lose enrollment	Repair the service
It is a Windows Update loop	ZSAUpm is the one rebooting	Read the service name

Proof the ticket is closed

• Services stay RUNNING after reboot

• No upgrade prompt

• User traffic still enrolled

Say this in an interview

A ZCC upgrade loop is a locked module or a failed service start. I read ZSAUpm before I push the package again.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/