Page Comparison

The default Arellia Agent and Arellia Application Control Solution (ACS) Agent installations allow Administrators to terminate those processes and services. This article will walk through how to prevent administrators from tampering with the Arellia Services.

Manual Steps

...

To secure Arellia agents, do the following steps:

1. Harden the Arellia Agent and ACS services need to be hardened against administrators (for details about service hardening, go to Service Hardening).

2. This alters the service Security descriptors such that an administrator cannot stop services via the Service Control Manager.

3. Second the Arellia processes can be protected against administrators by removing the Debug privilege from Administrators. The quick way to do it is enable

   Remove the debug privilege from Administrators by enabling the Remove Advanced Privileges for Interactive Users 

   application control policyDebug privileges are generally only made available to Developers.  Debug privilege disables checks on the process security descriptor. The 

   ACS policy.

   Note
   title Warning
   Debug rights trump Remove Advanced Privileges for Interactive Users

   policy would generally be cloned to actually exclude those programs (developer tools ) that actually require debug rights such as Visual Studio.The last step to protect the Arellia Agent Service is to remove the terminate privilege from Administrators. This can be done by creating a new Adjust Process Security action

   policy, so be aware anyone with debug rights will still be able to kill protected processes.

4. Remove the terminate privilege from Administrators by creating a new process security action and then applying it via an Application Control Policy targeting the "Arellia.Agent.Service.exe" executable. (For details about adjusting process security, go to Adjust Process Security.)

...

Related links

How to enable process and service hardening using ACS and LSS