Unresponsive Agent Settings

Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Unresponsive Agents 
Environment: Windows, MacOS
Summary: Changing unresponsive agent settings 

By default, Agents who have not called back to Huntress within 21 days (or agents that have not "checked in" within 3 days of install) will be marked as unresponsive regardless of the settings. An Agent that doesn't call back to Huntress after it's installed indicates an issue. Please follow the troubleshooting instructions here: Basic Troubleshooting.

In this article

1. Configuring Unresponsive Agent Settings
   1. Account-Level
   2. Organization-Level Overrides
2. Orphaned Agent
3. Basic Troubleshooting

We give you the ability to remove an Agent when it has not called back within a specified number of days. See Customize the Unresponsive Agent Settings below for more details.

Typically agents are unresponsive because the endpoint is offline, possibly decommissioned, or re-imaged, but occasionally is caused by something else. For Agent troubleshooting, visit the Basic Troubleshooting & Checking Huntress Status page.

If the endpoint has been decommissioned, the agent can be removed from your account by following these instructions.

When an agent is automatically removed from an account, it will be tasked to uninstall. Should the agent come back online, the uninstall task instructs the agent to remove itself from the computer. 

Huntress will task an agent to uninstall for 30 days. If the endpoint is offline for those 30 days, the Agent will not be uninstalled. When the endpoint is brought back online, it will be left with an Orphaned Agent. At any point after, if the endpoint attempts to contact the Huntress portal it will be tasked to uninstall.

Configuring the Unresponsive Agent Settings

Huntress gives you the option to update the thresholds at which agents are considered "unresponsive" and, optionally, automatically uninstall the agent. 

Customization Options:   

Account-Level:

• Number of days until an agent is considered unresponsive (Default: 21 days) 
  • 21, 30, 45, 60, or 90 days
• Number of days an agent is unresponsive before action is taken (Default: 7 days) 
  • 0, 7, 14, 21, or 30 days
• The action to be taken on unresponsive agents (Default: No Action).
  • No Action or Uninstall

Organization-Level:

• Number of days until an agent is considered unresponsive (Default: 21 days) 
  • 2, 7, 14, 21, 30, 45, 60, or 90 days
• Number of days an agent is unresponsive before action is taken (Default: 7 days) 
  • 0, 7, 14, 21, or 30 days
• The action to be taken on unresponsive agents (Default: No Action).
  • No Action or Uninstall

These options can be set on the Account Level and the Organization Level:

• Account Level will be the Global Default. 
• Organization-level settings will override the Account Level settings for granularity in organizations.

To change the thresholds at the Account-level, follow the steps below:

1. Login to the Huntress Web Interface.
2. To change the Account Level settings, hover over the Huntress options menu in the dashboard's upper-right corner.
   To change the settings for a specific organization, overriding the Account Level settings, go to the next section.
3. Select the Settings option from the menu.
4. On the Settings page, you will see a section labeled Unresponsive Agent Settings.
   1. Days Until Unresponsive - The number of days Huntress has not seen an agent before the Agent is considered unresponsive (Default: 21 days)
   2. Unresponsive Limit - The number of days an agent is unresponsive before action is taken on the Agent (Default: 7 days). 
   3. Unresponsive Action - Action to be taken after the agent has been unresponsive past the Unresponsive Limit (Default: No Action)

To change the Organizational Level, click the Organizations tab at the top menu in the portal. 

1. Find the organization you wish to modify and click the edit "pencil" icon. 

2. By default, all organizations will use the Account Level settings. Any changes you make here will override the account settings. This is helpful if you have a specific organization that may have longer unresponsive times than usual. 
3. We provide different options for "Days Until Unresponsive" at the organizational level. Once you've selected the appropriate settings, click the save button.
4. 

When Unresponsive Agents are uninstalled, all Admins will receive an email (this can't be turned off at this time!): 

Orphaned Agent

If Huntress does not get a response from the agent within 30 days, it is orphaned, and the Agent's key/token has been revoked by Huntress. At that point the agent is unable to send or receive any data from the Huntress portal and is essentially not performing security tasks anymore.

Re-running the deployment script on an orphaned agent will appear to work; however, the connection between the Agent and Huntress will not be restored. For the Agent to function and show again in the Huntress Dashboard, the Agent must be Uninstalled and Reinstalled.

If "Uninstall" is the selected unresponsive action, after the unresponsive period, the agent record will be moved to an "unresponsive" state, and uninstall tasks will be issued.
If the agent calls back within 30 days, it will pick up the uninstall tasks and uninstall itself from the endpoints. After 30 days, if the endpoint has not called back, it will be deleted from the dashboard. However, should the call back at that point, when authenticating with the portal, the agent will briefly instantiate long enough to hand off the Uninstall tasks to the host and uninstall itself.

Here is a list of documents that will help set up Huntress Agent monitors/Installs for RMMs.

Troubleshooting

For agent troubleshooting, visit the Basic Troubleshooting & Checking Huntress Status page.

Further questions/issues?

If you still need help, please use the "Contact Us" button below or send an email to our help desk at support@huntress.io. Please attach any logs you may have to help troubleshoot.