Splunk UF winhostinfo not running from time to time

[tlam_splunk]

Using the Splunk v663 UF in the window 2012 server.Find that Splunk can't collect the WinHostMon event suddenly from time to time. Need to restart the UF to get the events back.
Checking the log file,  it seems winhostinfo is going down, it will have the message:
“Couldn’t start command “c:\Program Files\Splunk\UniversalForwarder\bin/splunk-winhostinfo.exe” : Access is denied. “

[tlam_splunk]

Highly suspect it's the Anti-virus and firewall issue in the window server but cannot find any related log in the AV or firewall blocking it.

Upgrade to the v667 and have the issue fixed as the WinHostInfo process can be restarted in that version if it's down for some reasons. It's kind of workaround but it helps to resolve the issue.