Modifying the configuration file for a single endpoint

Verify that you are logged in as an administrator of the machine on which the agent is installed.

Turn off the agent default policy to permit the agent services to be stopped and restarted on all host endpoints.

Wait for the policy to propagate.

On the command line, navigate to the version agent installation directory where the xagt.exe file is stored. The default location is %ProgramFiles%\FireEye\xagt\ (32-bit environments) or %ProgramFiles(x86)%\FireEye\xagt\ (64-bit environments).

Export the agent_config.json file from the agent database:

xagt -x agent_config.json

Using a text editor, modify the configuration file to disable the dynamic update of the configuration file from the Endpoint Security (HX) server. To do this, change the config_pull_enabled key to false in the configuration file. If you fail to do this, any changes you make to the agent_config.json file will be overwritten the next time the configuration file is dynamically updated.

Make other changes (as needed) based on the instructions in the rest of this documentation.

When all changes have been made, run the file through a JSON validator to ensure that the JSON code is valid.

When the file has been validated, save it.

Disable Tamper Protection to stop the agent service.

Deny local permission to stop and start agent services.

Import the agent_config.json file back to the agent database:

xagt -i agent_config.json

Restart the agent.

sc control xagt paramchange

Turn on the policy to permit the agent services to be stopped and restarted on all host endpoints.