How do I stop users from disabling the EDR agent? (We use Trend Micro)

That's a classic problem with local admin rights. For Apex One, you need to lock down both the service control and the UI tray application. Group Policy is indeed the right tool.

Start with these two Computer Configuration policies:
- **Service Control**: Create a policy to deny "Stop, Start, and Pause" for the Trend Micro service (usually "TMBMServer" or similar). You'll find this under Windows Settings > Security Settings > System Services.
- **File System Permissions**: Block write/modify/execute access to the client UI executable, often something like `C:Program FilesTrend MicroUniClientUiFrmWrkuiSeAgnt.exe`. This prevents users from launching the tray icon to change settings.

The bigger architectural question is whether those users truly need local admin. That's often the root cause, and technical controls like these are just a workaround for a problematic permission model. Have you considered using a privileged access management tool instead?

Group Policy is the right path, but you'll need to go further than just the service. The tray icon is the real weak point because that's where the "Disable Real-time Scan" button lives.

Beyond the service lock, use a Software Restriction Policy or AppLocker rule to outright block the UI executable, usually `uiSeAgnt.exe`. Also, check the agent's own policy within the Trend console - there should be a setting to password-protect the client interface. Set that with a strong passphrase your users don't know.

Frankly, the sustainable fix is clawing back local admin rights. Every other measure is just a band-aid on a gaping wound. If your boss saw it in the console, use that as ammunition to start that conversation.

Start by looking in the Trend console itself. There's a client-specific setting to require a password to access the tray icon or change agent settings. Set that with a strong password your team keeps and users don't. It's the first lock you should turn.

The other replies cover the GPO side well, but that console password is your immediate, built-in stopgap.

Good advice in here already. The immediate win is definitely that built-in password in the Trend console. It's quick.

But I'd tackle the GPO stuff in this order for a new admin:
1. Set that console password first.
2. Then lock down the Trend service via Group Policy.
3. After that, block the UI executable path.

Doing it that way gives you layered protection while you figure out the permissions. And yeah, the real fix is taking admin rights away, but that's a longer battle. Start with these locks.

Yeah, that console password is the quickest win. But I'd test it after you set it - on some versions the password only protects the main settings menu, not the right-click "disable" option on the tray icon itself.

If you're already seeing this in your console alerts, you could also set up a Prometheus alert to fire if an agent goes offline. That way you're not just relying on someone checking the dashboard.

Good point on testing it. I've seen that exact behavior on older Apex One builds. The password just guards the front door while the tray icon has a back window wide open.

Prometheus for Windows agent monitoring? Overkill. You can just set a simple scheduled task to check the service state and mail you if it's stopped. No need to stand up a whole monitoring stack.

But really, if they can stop the service, they can kill your scheduled task too. The root problem is the admin rights, not the alerting.