When a reboot is required:
The agent install, upgrade, and uninstall does not usually require restarting host endpoints and does not prompt end users for action. The agent installation does not require or request a reboot on macOS or Linux. A reboot may be necessary to complete the Windows installation if a pending reboot has already been flagged to Windows as required by another product installation or Windows Update.
You can use the wevtutil qe Application command to query the Windows event log and determine whether a pending reboot is required before installing the agent. To query the event log, open the Windows command line and run the following command at the prompt:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1029]wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1029] and * [EventData[Data='FireEye Endpoint Agent']]"When a reboot is recommended:
There are cases where a reboot is recommended even though the product is successfully installed in order to replace binaries that are in use. The agent and these product features will remain operational, although the new product binaries will not be replaced until the OS is restarted.
Exploit Guard: When Exploit Guard monitors an application, it may still be running after the agent has been upgraded or uninstalled, and agent libraries loaded into that process for monitoring purposes may be in use by the running product. These libraries can only be unloaded when the process exits or in cases where the monitored application is a Windows service, when the OS is rebooted. In such cases, Windows may signal in the event log that a restart is required but has been deferred to a later time. A reboot is not, however, required at this time.
AMSI: The Anti-Malware Scan Interface is side-loaded by Windows into third-party and third-party processes executing scripts that are passed to the AMSI module by Windows. In some cases, those processes may still be running when the agent has been upgraded or removed, and thus still have the agent libraries loaded. In such cases, Windows may signal in the event log that a restart is required but has been deferred to a later time. A reboot is not, however, required at this time.
To query the event log for cases where the agent installer is signalling a reboot, open the Windows command line and run the following command at the prompt:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1029] and *[EventData[Data='Trellix Endpoint Security (HX) Agent']]"If a reboot is requested (but not otherwise required), the following message appears. This wording originates from Windows:
"Product: Trellix Endpoint Security (HX) Agent. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred to a later time."Post installation notes:
The following are actions that result in changes to the product configuration or files on disk after agent installation:
Upgrading HX to 10.0 and later will result in streaming down and installing the Audits Module from HX when a new Audits Module has been integrated into HX.
Enabling a module in the policy for an existing agent, upgrading a module via HX, or installing the agent for the first time will result in the module(s) streaming down from HX and installing on the agent automatically. Modules include data files, libraries, and, on Windows, for some modules, such as Extended Forensics, Device Guard, and UAC Protect, the installation of a Windows kernel driver. Modules that are integrated into the agent install, such as Real Time Event Detection, Malware Protection, and Exploit Guard, are not streamed down from HX.
Content, including data files as well as libraries, will be downloaded from their respective sources for Real Time Event Detection, Malware Protection, Exploit Guard, and IOC Streamer.