The xagtnotif.exe program handles all agent notifications on the endpoint. A copy of the xagtnotif.exe program automatically runs with each user login and is required for Malware Detection and Exploit Guard. This section provides how to instructions for disabling and enabling xagtnotify.exe.
Note
You can use an enterprise-wide software delivery program such as SCCM to automate the reg commands for disabling and enabling xagtnotify.exe.
reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v xagtnotif /reg:32 /f
Open a Windows command prompt as an administrator.
Run the following command:
Note
xagtnotif.exe will continue to run after the service is stopped and disabled.
If your agent configuration has Exploit Guard and malware protection enabled, you must follow these steps to enable xagtnotif.exe.
reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v xagtnotif /t REG_SZ /d "%windir%\FireEye\xagtnotif.exe -n" /reg:32 /f
Open a Windows command prompt as an administrator.
Run the following command: