System Overview – System Agent
Table of Contents
What the Agent Does
The AutoElevate software installed on each computer monitors reports, on, and responds to UAC privilege events and is collectively referred to as the “AutoElevate System Agent.” The AutoElevate Agent operates in either Audit, Policy, Live, or Technician mode. Upon installation, Agents are placed in Audit mode by default; however, the Agent should be changed into Live mode for primary testing purposes.
How to Change Agent Modes
In the Admin Portal (https://msp.autoelevate.com ), from the Computers screen, select the check box next to the computer(s) you would like to change, and then from the Actions menu, select Set to Live under Agent Mode. You are ready to test once the Agent checks in and picks up the setting (check-in happens every 5 minutes). Refresh the data using the "Refresh Data" button in the top right-hand corner to refresh your view, and then look at the 'Agent Mode' column to see if the Agents have picked up the new Agent mode setting.
Agent Modes Defined
Audit - All UAC events are logged, but the Agent does not respond to or apply defined rules and, therefore, no change to the user experience.
Policy - Policy mode will apply and process any defined rules. Still, for any event with no corresponding rule, it will NOT invoke the Real-Time evaluation process but instead allow the UAC to appear to the user. Policy mode will allow an you to make and apply rules for critical applications with an immediate use case benefit. Still, it will not prompt the user or technician to evaluate anything unknown.
Live - All UAC events are intercepted, and rules that have been defined are applied (to either elevate with privilege or block). For any event with no corresponding rule, the end user will be given the choice to proceed with a privilege request. The privilege request causes any company-access technician to be notified and open a ticket (if you have an integrated PSA ticketing system). The technician is presented with information on who is making the request, what they are requesting, the basic security disposition of the machine, and whether the application or action they want is safe, along with the ability to respond to the user's request in real-time.
Technician - Special mode enabling onsite Technicians to interact with the computer's UAC prompts. Please see the Technician Mode documentation on our support site.
More About The AutoElevate Agent Components
The components that make up the System Agent are the AutoElevate Agent service, which is set to start automatically at Windows startup and then spawns the AEAlert and AEUACAgent applications once a user is logged in. When the AutoElevate Agent service is stopped, the computer resumes standard, UAC functionality, and UAC events are no longer tracked.
Please take a look at System Agent Installation in our support documentation for more detailed instructions on Agent deployment options.