To allow your system administrators to stop and restart Trellix Endpoint Security (HX) xAgent services for selected host sets in your environment, use the Web UI to create or modify a custom policy that disables the Tamper Protection policy. The tamper protection policy will apply to Windows hosts running Endpoint Security (HX) xAgent version 29 or later only for the selected host sets.
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Important
: Trellix does not recommend disabling your Tamper Protection policy because it may allow users with administrative rights, threat actors, and malware to compromise your endpoint protection.
To allow the stop and restart of agent services on selected host sets:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click link for the custom policy you want to modify.
Click the Tamper Protection tab.
Toggle the ON/OFF switch next to Deny local admin permission to Start and Stop to OFF.
Click Save to save the policy settings.
To allow agent process injection and inspection on selected host sets:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Custom Policy link to go to the Edit Policy page.
Select the Tamper Protection tab.
Toggle the ON/OFF switch next to Protect the agent process from injection and inspection to OFF.
Click Save to save the policy settings.
To stop preventing unauthorized users and processes from tampering with agent files and folders:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Custom Policy link to go to the Edit Policy page.
Select the Tamper Protection tab.
Toggle the ON/OFF switch next to Prevent unauthorized users and processes from tampering with Trellix agent files and folders to OFF.
Click Save to save the policy settings.
After creating your custom policy, you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
To disable strict certificate validation of xAgent files:
Important
The default value for this setting is ON. However, if you are experiencing PKI failure in your environment, you can use these steps to turn strict certificate validation off. Only endpoints running Endpoint Security (HX) xAgent version 34 or later can enable or disable strict certificate signing.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Tamper Protection tab.
Toggle the ON/OFF switch next to Perform strict certificate validation on agent binaries to OFF.
Click Save to save the policy settings.