Maybe be an idea to password protect the agent installation to prevent unauthorised uninstall as well
Mikel from Gorelo
Team
Just to clarify things here: the agent does not show up in ‘Programs and Features’ and the only way to uninstall is via a script with an elevated PowerShell session. An end user can’t accidentally uninstall Gorelo :)
If we did progress with this feature, it would likely be in the form of an alert so you can then either dismiss or create a ticket.
Aquamarine Pie
Currently the uninstall script is public. Which means for end users that aren’t admin locked down (Yes sadly there are some we can’t), they can just go find the script and run it themselves.
Not sure what the best solution is here, but certainly any smart cookie can figure out how to disable and remove Gorelo themselves. (or just get AI to help them)
Even just updating your uninstall script to include an alert for now would be a good start.
Amaranth Cherry
I concur that an uninstall notification or alert would be great. Even better if there is a unique uninstall password per agent as most NGAVs have.
Coral Deer
Yes please, although users shouldn't generally have admin rights to uninstall.
Salmon Yogurt
This would be awesome to get as an alert!
Copper Supernova
Uninstall notification would be great. Password protection is also very useful.
Lime Sunbeam
Or even better maybe an uninstallation code?
Sapphire Horizon
SyncroMSP agent and Crownstrike agent require a password or token to uninstall. That is good.
Jade Petal
Either a passworded uninstall or an alert would be great!
Tan Tomato
Anyone using Threatlocker - you can prevent this Globally. But I agree, an uninstall code would be ultimate solution.
Log in to comment and vote
Comments11
Coffee Moss
Maybe be an idea to password protect the agent installation to prevent unauthorised uninstall as well
Mikel from Gorelo
Just to clarify things here: the agent does not show up in ‘Programs and Features’ and the only way to uninstall is via a script with an elevated PowerShell session. An end user can’t accidentally uninstall Gorelo :)
If we did progress with this feature, it would likely be in the form of an alert so you can then either dismiss or create a ticket.
Aquamarine Pie
Currently the uninstall script is public. Which means for end users that aren’t admin locked down (Yes sadly there are some we can’t), they can just go find the script and run it themselves.
Not sure what the best solution is here, but certainly any smart cookie can figure out how to disable and remove Gorelo themselves. (or just get AI to help them)
Even just updating your uninstall script to include an alert for now would be a good start.
Amaranth Cherry
I concur that an uninstall notification or alert would be great. Even better if there is a unique uninstall password per agent as most NGAVs have.
Coral Deer
Yes please, although users shouldn't generally have admin rights to uninstall.
Salmon Yogurt
This would be awesome to get as an alert!
Copper Supernova
Uninstall notification would be great. Password protection is also very useful.
Lime Sunbeam
Or even better maybe an uninstallation code?
Sapphire Horizon
SyncroMSP agent and Crownstrike agent require a password or token to uninstall. That is good.
Jade Petal
Either a passworded uninstall or an alert would be great!
Tan Tomato
Anyone using Threatlocker - you can prevent this Globally. But I agree, an uninstall code would be ultimate solution.