Agents on Windows Systems

This section of the Privilege Manager documentation covers information and step procedures pertaining to Privilege Manager agents installed on Windows systems.

The following topics are available:

• Agent Configuration
• Windows Agent Utility
• Agent Hardening 10.7.1 and up
• Pre-10.7.1 Agent Hardening
• Setting the Server Address
• Elevating Fully Trusted Universal Windows Platform (UWP) Applications
• Troubleshooting
• Memory Protection

Processes Run by Agents

C:\Program Files\Thycotic\Agents\Agent

• Arellia.Agent.Service.exe runs automatically as a native NT service at system start time.

  • This is commonly known as the agent's "Core" service, with a service name of ArelliaAgent and a service display name of Thycotic Agent.

• Agent Utility.exe runs on-demand on the user's desktop whenever the user launches it.

• Thycotic.Agent.User.exe runs on-demand on the user's desktop. for a brief period of time, whenever the ACS (Application Control Service) executes a Display User message (Application action).

• Remove Programs Utility.exe runs on-demand on the user's desktop whenever the user launches it.

• TaskExecutor.exe runs as a native NT service to execute scheduled tasks based on the tasks defined by policies under the Windows Task Scheduler.

C:\Program Files\Thycotic\Agents\ApplicationControl

• ArelliaACSvc.exe runs automatically as a native NT service at system start time.

  • This is commonly known as the ACS (Application Control Service), with a service name of ArelliaACSvc and a service display name of Thycotic Application Control.

• MSIElevateHost.exe is launched invisibly within the user's desktop session by the AppInfo (Application Information) service to facilitate policy-based elevation operations for MSI installers.

• COMElevateHost.exe is launched invisibly within the user's desktop session by the AppInfo (Application Information) service to facilitate policy-based elevation operations for COM operations.

• JITModeManager.exe runs on-demand on the user's desktop whenever the user launches it. This program is used to make requests to have JIT mode approved.

• ArelliaDisplayXamlAction.exe runs on-demand on the user's desktop. for a brief period of time, whenever the ACS (Application Control Service) executes a Custom Xaml Execution action (Application action).

• AdvMessageAction.exe runs on-demand on the user's desktop for a brief period of time, whenever the ACS (Application Control Service) executes a Display Advanced message (Application action)".

• Delinea.Agent.TrayIcon.exe runs on the user's desktop and displays status information via tray icon present in the "SysTray" area on the task bar.

• Arellia.Agent.InventoryHelper.exe is launched invisibly within the user's desktop session when the ACS (Application Control Service) executes an Immediate File Inventory action.