Kaseya Community

How to protect the agent from getting turned off

This question is not answered

Hey there,

 

i have some coworkers who feel bothered by the agent and just turn it off (kill the service).
i want the service and process not to be able to get killed.

i have no idea how to do that :(
i was already searching here and found some answeres which didnt help.

there was one idea about starting a batchfile on an online-agent and the batchfile will start the agent-service through the network but the problem was that its not working on the different OS. We have all kinds of Windows OS running, XP-Windows 7 and Windows servers.
Also i want it to happen automaticly and i have no idea how to do that with a batchfile. It needs to proof currently if the service and process is running and if not they need to be restarted.

also, if i would handle this with kaseya which starts an script which starts the agent through the network, i have no idea how kaseya could see the different bertween a killed agent or a turned off machine.

did one of you have the same problem and you have a solution?
do one of you have an idea what could help?
maybe somebody knows how to configure the service and process so its not able to be turned off.

thanks,

Sander

All Replies
  • Sweet!

  • Not sure I follow you mmartin... doesn't make sense for this instance. Sanders was talking about coworkers, not a client. So if coworkers are breaking policy, the correct action is to report it to a supervisor instead of ignoring it as "oh well, they'd probably not do anything about it anyway". Eventually, the boss will wonder why you aren't doing your job (are why you're jumping through hoops for uncooperative employees?).

  • David, I think the point is more that sometimes you just need to fix the problem immediately, and then jump through the HR hoops. Believe me, I am never an advocate for solving a social problem with a technical solution, but using technology to make life easier? Certainly!

  • I got that... (I'm just in a hard as$ mood today!) But what I usually find in these situations, if you don't take a little extra time upfront to do it right, you end up wasting more time on the backend (usually because you don't end u doing anything about it).

    But hey, I really do like the solutions above too!

  • Hey there,

    of course i wish we could just tell them to stop and thats it.  

    but my boss knows about it and told me too find a solution to lock the kaseya agent.

    so i´m looking for a solution ;)

    right now i have something more important to do, but when its done i will try the script and report if it worked :)

    Wish you a blessed rest of the week

  • Ok, i´m back.

    Mmartin how am i supposed to use the xml file?

    Do you just import it to the Kaseya scripts? I guess i have another Version of Kaseya than you and so its not working for me.

    Also the SC command is not helping. Tried that already. When i stop the service properly, it doesnt restart itself.

    Those settings are in case the service is not running correctly anymore i guess.

    Please anybody read my post before and help me if you can.

    Thank you a lot,

    Sander

  • lock-and-unlock-script-screencaps.zip

    Sorry Sander, when I posted my scripts for you I missed the part where you said: "We are working with Managed Service Edition - G1  :  5.2.0.0."

    We're on 6.2. I'm sorry, I don't know what is required to make them work on 5.2. In theory, you're wanting to run the same commands against your endpoints, so how about I attach a screen dump of the procedures instead of the XML, so you can read the steps more easily and convert them yourself?

    Sorry, I've not yet added the cool extra from SMason.

    Cheers,

     

    Greig.

     

  • The SC on stop won't restart it as you stopped it correctly, it is only there if somebody kills the agentmon that way it thinks it crashed and restarts.

    See can you get the info from Greig's screenshots if not I will post just the commands - the commands I have set the permissions on the service so it cannot be stopped by the random user..

  • Hey :)

    So nobody knows how to help me here? :(

  • We did....

    You need to set the permissions on the service to stop people from stopping it (use the script posted earlier). You also have to prevent people from ending AgentMon.exe with the Service Recovery trick.

  • Hey SMason,

    we already found out, that i cant use those scripts because we are running Managed Service Edition - G1  :  5.2.0.0.

    So its helping everybody else here but not me. thats why i asked again for help.

    Did i miss something? What Service Recovery Trick do you mean?

    I would be so happy to finally find a way to solve the problem, hope the trick can help me :)

    Oh and happy Thanksgiving !

    :-)

  • Still not answered...

    Users can still uninstall the Agent or just stop the service. how can i change this?

  • Hi Sander,

    Is there any reason you have not upgraded to V6.2? Most people have which means until you do you won't be able to import scripts from these forums :( as nothing for V5 seems to get posted anymore.

    Coming back to your question it would appear Greig has answered it by sending you screenshots of his Kaseya script. You simply need to make your own script to make these changes.

    As for removing the ability to uninstall the software,you simply need to remove the add/Remove entry from HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall in the registry.

    Finally you simply need to find out how to manipulate the registry to have the service automatically try to restart when it is stopped - this should restart it when they stop the exe in task manager. This is not hard to do but I do not have the information at hand.

    Finally, have you talked to your boss about removing administrator privileges from the workstations? There is a good argument for those privileges being abused here.

    Regards,

    Chris.