Enable Self Protect on hosts
Xprotect agents can be uninstalled from a host, either from the host's UI or CLI or other app management utilities. The only requirement to uninstall is that you must have administrative privileges on the host. Uninstalling the agent moves the host out of the protection and policies from the Xprotect instance.
To hamper accidental or rogue uninstalls of the Xprotect agent from a host, enable the Self Protect feature on the host. When you enable Self Protect, the agent cannot be uninstalled from the host's UI. The agent can be uninstalled from the UI only after the Self Protect feature is disabled on the host.
Currently, the Self Protect feature can be enabled only on Windows hosts. Enabling Self Protect on a host prevents uninstalling the agent from the host. However, you can perform all other operations such as upgrade, restart, push policies, fetch or isolate files on the host.
Enable Self Protect
The Self Protect feature is enabled at the host level and not an Xprotect policy or group.
The actual time when the Self Protect feature is enabled or disabled on the host depends on when the last operation was performed on the host and the duration you specify for the Agent Fetches Command Every option (on the Policies > Policy Settings > Advanced page).
|
|
Disable Self Protect
Disable the Self Protect feature when you want to decommission the host
-
To disable Self Protect, click the 3-dot menu of the host and Self Protect to Off (turns Grey).
Verify Self Protect status
See the Audit logs to verify the status of the Self Protect on a host after you enable or disable the feature on the host.
The Audit Status column on the Audit Logs page will show Partial Success until the job schedule to enable or disable Self Protect is executed on the host.
-
Go to Settings >Audit Logs.
-
Filter the page by audit actions Self Protect On or Self Protect Off.
-
Verify the status of Self Protect.