The deny_local_admin_stop key indicates whether agent protection is activated or disabled for agent service. Valid values are true (protection is activated or enabled) and false (protection is not activated or disabled). The default is true, which means your system administrators cannot stop or restart the Endpoint Security (HX) Agent service on your Windows endpoints.
This protection is provided only for Windows agents running Windows Vista, Windows 2008, or later Windows versions. It prevents or allows agent service termination.
The deny_local_admin_stop setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"priority": "idle",
"cpu_limit": 100,
"deny_local_admin_stop": true
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (See Configuring a Tamper Protection Policy).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).