Unresponsive Agent Settings

Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Unresponsive Agents 
Environment: Windows, MacOS
Summary: Learn how to adjust unresponsive agent thresholds and configure automatic uninstalls at the account or organization level.
 

In this article

• Details
• Configuring unresponsive agent settings
  • Account-level settings
  • Organization-level overrides
• Notification Message
• Process Examples
  • Default Example
  • Customized Example
• Basic troubleshooting
   

Details

Typically, agents become unresponsive because an endpoint is offline, decommissioned, or reimaged. If an agent does not check in to Huntress after installation, it indicates a connectivity or installation issue.

By default, the Huntress Agent is marked as unresponsive if it hasn't checked in with the Huntress portal for 21 days (or within 3 days of a new installation). This article explains how to customize these thresholds and automate uninstalls for decommissioned or offline endpoints.
 

Configuring the Unresponsive Agent Settings

You can update the thresholds for when agents are considered "unresponsive" and choose whether Huntress should automatically attempt to uninstall them.

• Account-level: Sets the global default for all organizations.
• Organization-level: Overrides account settings for specific client needs.

Customization options

To change thresholds at the account level:

1. Log in to the Huntress portal.
2. Hover over the Huntress options menu (hamburger icon) in the upper-right corner.
3. Select Settings.
4. Scroll to the Unresponsive Agent Settings section and adjust the following:
   • Days Until Unresponsive: The number of days before the agent is marked unresponsive.
   • Unresponsive Limit: The number of additional days before the Unresponsive Action is taken.
   • Unresponsive Action: Select No Action or Uninstall.
     
     

To change thresholds at the organization level:

1. Log in to the Huntress portal.
2. Select the Organizations tab from the top navigation bar.
3. Find the organization you want to modify and select the Edit (pencil) icon.
4. Update the settings in the Unresponsive Agent Settings section. These settings override the account-level defaults.
5. Select Save.

Notification Message

When an unresponsive agent is uninstalled, all admins receive an automated email notification. This notification cannot be disabled at this time.

Process Examples

Default Example: 

Say you have left the settings at the default (21 days until unresponsive, 7 additional days before action is not taken, No Action), then you can expect the following:

• At the 21 day mark, the agent will be marked "unresponsive" in the Huntress portal
• At the 28 day mark, the agent will be flagged to not take any further action
• The agent will continue to be marked unresponsive but still be present in the portal. 

Customized Example:

Say you have modified the settings (30 days until unresponsive, 14 additional days before action is taken, Uninstall), then you can expect the following:

• At the 30 day mark, the agent will be marked "unresponsive" in the Huntress portal
• At the 44 day mark, the agent will be sent the uninstall command and is automatically removed from the Huntress portal 
  • If the computer is online, the Huntress agent will be uninstalled from the endpoint 
  • If the computer is not online, the uninstall command is sent to the endpoint where this process will attempt to run for up to 30 days before it times out.
• Email notification will be sent to admins alerting them to the uninstall
• Manual uninstall (if services still present) and reinstall is required to return the agent back to the Huntress portal 
   

Troubleshooting

If an agent is unresponsive but the endpoint is still active, see our Why Has an Agent Not Checked In? and Why Has a New Agent Not Checked In? guides. 

For help with RMM agent monitor tasks, refer to our RMM Service Monitor Guides.