Endpoint Security Agent (HX) software supports tamper protection settings that prevent the unauthorized removal of agent software from your host endpoints, agent process and service terminations, agent process injection and inspection protection, and agent database tampering. See the Endpoint Security Agent (HX) Administration Guide for more information about configurable and non configurable Endpoint Security Agent (HX) tamper protection settings.
Note
To improve agent protection on your host endpoints, Endpoint Security Agent (HX) version 27 and later disables functionality in the Windows Service panel that allows administrators to manage or terminate agent service on the host endpoint. The sc stop xagt and net stop xagt commands are also disabled.
Agent Removal Protection
Endpoint Security Agent (HX) version 26 or later provides support for configuring a Removal Protection Password policy that prevents unauthorized users from removing the agent software from host endpoints in your enterprise.
See Configuring the Agent Removal Protection password for more information.
Agent Tamper Protection
The Agent Tamper Protection policy allows you to protect the Endpoint Security Agent (HX) software on your Windows endpoints so that you can have full control over the programs and applications running on your endpoints. This agent policy has two protection components. It prevents agent services from being stopped and restarted on your endpoints and protects the agent process from injection and inspection.
Note
TrellixEndpoint Security Agent (HX) version 20 or later supports the Tamper Protection policy's injection and inspection protection component for Windows endpoints only.
TrellixEndpoint Security Agent (HX) version 29 or later supports the Tamper Protection policy's start and stop functionality for agent services on Windows endpoints only.
Important
Trellix does not recommend disabling your Tamper Protection policy because it may allow users with administrative rights, threat actors, and malware to compromise your endpoint protection.
See "Configuring a Tamper Protection Policy" in the Endpoint Security Agent (HX) Administration Guide for more information.