Kaseya Community

Notification of agent deletion

  • Is there a way to get a notification/report of an agent(s) being deleted (including the user that deleted it)?

  • That information on the machine side would be stored in the Application Eventlog, filter for Event ID's 11707 and 11724.

    Also you can disable the Uninstall option;
    1) From Add/Remove Programs on the machine side, the MSP Builder configuration files makes very easy to do.
    2) limit access to uninstall the agent on the VSA side for the Tech staff using the user roles.



    updated
    [edited by: HardKnoX at 4:30 AM (GMT -7) on Apr 2, 2020]
  • The only way to know (out of the box) if an agent is "uninstalled" is when it no longer checks into the VSA, you could potentially leverage the Agent Offline status to let you know when this occurs but there is no easy way to differentiate between the agent being just offline or it being uninstalled since the uninstall process stops the agent from running.

    If I had to do it I would make it independent of the agent and use the Windows Task Scheduler to trigger a once off email alert when the Event Id related to the uninstall with a description relating to the agent is detected.



    updated
    [edited by: HardKnoX at 4:36 AM (GMT -7) on Apr 2, 2020]
  • We actually built a tool a few years ago that logged the agent config (server, machine group, etc.), checked the agent service every hour to ensure it was running, and if it found the service missing, it would use the logged information to download the agent and re-install it.

    It was for a specific customer environment where the developers had local admin access and kept removing the agent. This ran as a system service, so didn't depend on anything VSA-related. After a few weeks, the developers stopped fighting a losing battle. It's a fairly extreme measure that I would not use everywhere, but could handle problematic users.

    HardKnox's solution is pretty simple to implement, as you can easily trigger a task scheduler event by Event Log activity. You'd probably want to utilize Blat or a script with CDO to send the email so it doesn't depend on the user's email.

    Glenn

  • For agent uninstall notifications i use a weekly report on the VSA System log.
    The VSA user who deleted the agent is logged along with the agent name and timestamp.
    Create a report: Report Parts - Logs - System Log

    Filter on Event Description -> Like "Account"



    typo
    [edited by: Patrick van Strien at 5:53 AM (GMT -7) on Apr 2, 2020]
  • For agent uninstall notifications i use a weekly report on the VSA System log.

    The VSA user who deleted the agent is logged along with agent name and timestamp.

    Create a report: Report Parts - Logs - System Log

    Use a filter on Event Description: Like "Account"