Agents on Windows Systems

This section of the Privilege Manager documentation covers information and step procedures pertaining to Privilege Manager agents installed on Windows systems.

The following topics are available:

Processes Run by Agents

C:\Program Files\Delinea\Privilege Manager\Agents\Agent

  • Arellia.Agent.Service.exe runs automatically as a native NT service at system start time.

    • This is commonly known as the agent's "Core" service, with a service name of ArelliaAgent and a service display name of Delinea Agent.

  • Agent Utility.exe runs on-demand on the user's desktop whenever the user launches it.

  • Thycotic.Agent.User.exe runs on-demand on the user's desktop. for a brief period of time, whenever the ACS (Application Control Service) executes a Display User message (Application action).

  • Remove Programs Utility.exe runs on-demand on the user's desktop whenever the user launches it.

  • TaskExecutor.exe runs as a native NT service to execute scheduled tasks based on the tasks defined by policies under the Windows Task Scheduler.

C:\Program Files\Delinea\Privilege Manager\Agents\ApplicationControl

  • ArelliaACSvc.exe runs automatically as a native NT service at system start time.

    • This is commonly known as the ACS (Application Control Service), with a service name of ArelliaACSvc and a service display name of Delinea Application Control.

  • MSIElevateHost.exe is launched invisibly within the user's desktop session by the AppInfo (Application Information) service to facilitate policy-based elevation operations for MSI installers.

  • COMElevateHost.exe is launched invisibly within the user's desktop session by the AppInfo (Application Information) service to facilitate policy-based elevation operations for COM operations.

  • JITModeManager.exe runs on-demand on the user's desktop whenever the user launches it. This program is used to make requests to have JIT mode approved.

  • ArelliaDisplayXamlAction.exe runs on-demand on the user's desktop. for a brief period of time, whenever the ACS (Application Control Service) executes a Custom Xaml Execution action (Application action).

  • AdvMessageAction.exe runs on-demand on the user's desktop for a brief period of time, whenever the ACS (Application Control Service) executes a Display Advanced message (Application action)".

  • Delinea.Agent.TrayIcon.exe runs on the user's desktop and displays status information via tray icon present in the "SysTray" area on the task bar.

  • Arellia.Agent.InventoryHelper.exe is launched invisibly within the user's desktop session when the ACS (Application Control Service) executes an Immediate File Inventory action.

Enabling Verbose Agent Logging on Windows

The Privilege Manager Windows agent logs to the PMAgent/Operational Windows event channel. The Application Control components record error, warning, and information events by default. Trace detail is suppressed. When Delinea Support is diagnosing a policy or elevation issue, they may ask you to raise the level, so trace detail is captured while you reproduce the problem.

Enabling Verbose Logging

Administrator rights are required for this feature.

Set the following registry value on the endpoint, then restart the Application Control service or wait for the agent to pick up the change (see below).

Key HKEY_LOCAL_MACHINE\SOFTWARE\Arellia\Agent
Value LoggingSeverity (REG_DWORD)
Data 0x000000FF verbose — 0x00000007 default 

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Arellia\Agent' -Name LoggingSeverity -Value 0x000000FF -Type DWord

LoggingSeverity is a bit mask: 0x00000007 records error, warning, and information—the default, and also the behavior when the value is absent. 0x000000FF records all levels, including trace.

When Changes Takes Effect

The Application Control components ArelliaACSvc.exe, ArelliaAppInfo64.dll, and the code loaded into running applications. They re-read the value on their own, roughly once per minute. Wait a full 3 minutes before reproducing the problem.

Viewing the Details

Trace records are filtered out of the log viewer by default.

To view them:

  1. In the Agent Utility, click View Logs.

  2. In the filter row at the top right of the window, select the Trace check box. Note that Error, Warning, and Information are selected by default, but Trace is not.

The records are also visible in Event Viewer under Applications and Services Logs > PMAgent > Operational.

Capturing a Diagnostic Set

  1. Set LoggingSeverity to 0x000000FF and wait 3 minutes.
  2. Clear the channel. Event Viewer > Applications and Services Logs > PMAgent > Operational > Clear Log, or wevtutil cl "PMAgent/Operational" from an elevated prompt.
  3. Start a Process Monitor (Procmon) capture.
  4. Reproduce the problem, then stop the capture and save it as a .pml file.
  5. Run Agent Utility.exe as administrator from C:\Program Files\Thycotic\Agents\Agent\ and click Support File. It writes a zip archive to your desktop containing the information.
  6. Upload the .zip and the .pml file to your Delinea Support case.
  7. Turn verbose logging back off.

Disabling Verbose Logging

Set LoggingSeverity back to 0x00000007, or delete the value entirely, then allow a few minutes for the change to be picked up.

The channel is a 20 MB ring buffer and wraps quickly with Trace enabled—collect your diagnostics promptly and revert when finished—verbose logging does not turn itself off. The size can be adjusted with the Set Agent Log Size (Windows) client policy.

section article applies to Privilege Manager 13.0 and later, which logs to the PMAgent/Operational channel. On 12.x agents the same LoggingSeverity value applies, but the log is named Arellia. Substitute it wherever PMAgent/Operational appears.