You can use the disguise installation mode to hide the agent from the Windows Control Panel programs list and conceal the service name and description. To disguise the installation of the agent, you will need to run the installation with the DISGUISE=1 option, change the agent display name, and the agent service description.
Important
An upgrade job sent from Endpoint Security (HX) will not preserve the disguised settings. Trellix recommends uninstalling the existing agent software and then reinstalling the latest agent software version with the proper disguise parameters.
When you disguise the agent, the following changes occur:
The Add/Remove program registry keys are not installed, so the disguised agent software does not appear in Windows Programs and Features. This means that it cannot be uninstalled from there. To uninstall a disguised agent, run the installation
.msifile from the command line, but be sure you use the.msifile for the same agent version that is installed on the host endpoint.The agent service description is empty. In an undisguised installation, it is
FireEye Agent.The agent display name changes from Endpoint Security Agent (HX) to the value you input.
The agent service description changes from Endpoint Security Agent (HX) to the value you input.
The following example disguises the agent installation, changes the Display Name to My Service, and changes the Service Description to My Service Description:
msiexec.exe /i xagtSetup_x.x.x_universal.msi DISGUISE=1 DISPLAYNAME="My Service" SVCDESCRIPTION="My Service Description"