Breadcrumbs

Windows

Overview

The EnforceDNS Agent empowers organizations to leverage the robust capabilities of EnforceDNS on their roaming devices. Functioning as a DNS Proxy, the Agent offers a straightforward, lightweight, and highly effective solution to extend the full benefits of EnforceDNS to your mobile workforce.

This page will review the Agent installation procedure for a Windows machine. We’ll give you both UI and PowerShell options along with some troubleshooting steps if you get stuck along the way.

The Agent currently uses branding for HYAS Protect, including the app icon in the System Tray. This will be updated in a future release.

Architecture

  • The Agent consists of two parts, a service and a UI (user interface)

    • Service/Backend: The service, also known as the backend, is responsible for the core functionality and logic of the Agent.

    • The UI, also known as the front end, is the part of the application that users interact with.

  • For purposes of this document, when referring to the Agent, we mean the service and the UI together.

Starting the Agent UI

By default, the Agent’s UI will not launch upon install. However, the Agent service is running and protecting your machine in the background.

The Agent UI provides feedback, status updates and other information related to the Agent. If you wish to start the UI to view these, please perform the following steps:

  1. To start the Agent UI:

    1. Navigate to the search bar and type “HYAS Protect”

      1. Screenshot 2024-04-01 at 4.24.11 PM.png

    2. Click on the HYAS Protect app

      1. Screenshot 2024-04-01 at 4.24.28 PM.png

Checking Agent Status

When checking status, keep in mind that the Agent communicates with the EnforceDNS backend approximately every 5 minutes, so statuses may not appear immediately in the EnforceDNS Portal.

EnforceDNS Portal

Administrators may check the status of all Agent’s from the ‘Manage’ tab in the ‘EnforceDNS Agent’ section of the EnforceDNS Portal.

  1. Login to EnforceDNS, click on Settings> Organization Settings> EnforceDNS Agent> Manage.

    Screenshot 2024-08-09 at 3.01.10 PM.png

  2. From this view, you can check the ‘Status’ column to get information on the status of all the Agents.

EnforceDNS Agent UI

It is also possible to check the status of the Agent on the local machine itself.

By default, the Agent’s UI will not launch. However, the service will still be running and actively protecting your machine whether the UI is open or not.

  1. Ensure the Agent UI is running:

    1. If you do not see the HYAS icon in the System Tray, the Agent UI is not running. This does not mean that EnforceDNS is not protecting the machine. This only means the UI is not running.

      1. Screenshot 2024-08-13 at 2.59.35 PM.png

    2. To start the Agent UI follow the instructions listed above under ‘Starting The Agent UI’

  2. With the UI running, click on the HYAS icon in the System Tray.

    1. You’ll be presented with the following window:

      Screenshot 2024-08-13 at 3.04.02 PM.png


  3. Green means everything has passed checks and is working properly. Red signifies that there is an issue with the status and further troubleshooting may be required.

Agent Status Definitions

Protection Active

  • This shows the overall status of the Agent.

Internet Check

  • The EnforceDNS service performs the DNS query directly to the EnforceDNS cloud resolver. If this works, the service can reach the internet and can reach the EnforceDNS cloud backend.

Proxy Check

  • The EnforceDNS service performs the DNS query to 127.0.0.1:53. If this works, the service is correctly listening on 127.0.0.1:53, and can reach the internet and the EnforceDNS cloud backend.

OS Check

  • The EnforceDNS service asks the OS to perform the DNS query. If this works, the OS is configured to use 127.0.0.1:53 for DNS, the service is correctly listening on 127.0.0.1:53, and can reach the internet and the EnforceDNS cloud backend.

Agent Preferences

The Agent on the local machine includes configurable preferences to provide greater flexibility, visibility, and advanced troubleshooting. To access Preferences, start by navigating to the System Tray and click on the HYAS icon.

Screenshot 2024-08-13 at 3.04.02 PM.png

  • Once you click on Preferences, you’ll see the three options below:

Screenshot 2024-04-01 at 4.08.42 PM.png

  • Start UI at login

    • Enabling this will ensure that the UI is started on machine login.

The Agent will still run in the background, and be protecting your machine, regardless whether the UI is running or not.

  • Notifications

    • Turning this on allows the EnforceDNS Agent to send you notifications regarding connectivity or errors that may have occurred.

  • Debug Mode

    • Toggling this on can be useful if you’re having issues with your Agent. This feature enables additional logs to be collected for Client Admin or threatER analysis.

Disabling/Enabling the Agent

Disabling

There are a few different options to “turn off” the Agent.

Disabling the UI only

This turns the UI off but allows the Agent to still run in the background.

  1. Click on the HYAS icon in the System Tray to access the settings. You’ll see the following popup:

    1. Screenshot 2024-08-13 at 3.04.02 PM.png

    2. Clicking “Quit” will turn off the Agent UI.

The Agent will still run in the background, and be protecting your machine, regardless whether the UI is running or not.

Re-enabling the UI only

  • If the HYAS icon is missing from the System Tray, it means the UI isn’t running.

Disabling Protection Locally

If you wish to disable the Agent completely, you must stop the service itself.

This will completely stop EnforceDNS from running and it will no longer be protecting your machine.

  1. Click on the HYAS icon in the System Tray.

  2. Select, ‘Disable Protection’

    1. This will disable the Agent completely for a period of 15 minutes.

If you are unable to select ‘Disable Protection’, your Administrator must toggle the feature on via the EnforceDNS Portal. Instructions for Admins on completing that can be found here.

Re-enabling Protection Locally

The Agent will automatically restart after 15 minutes. However, if you wish to restart the Agent sooner perform the following:

  1. Navigate to the HYAS icon in the System Tray, click on it and select ‘Enable Protection’

Screenshot 2024-08-13 at 3.15.32 PM.png

  1. This will re-enable the Agent to begin protecting your device again.

Disabling Protection via the Agent Portal

EnforceDNS Admin privileges are required to manage agents in the Portal.

  1. Navigate to the Manage tab in the EnforceDNS Portal.

  2. Select the Agent(s) you wish to disable by selecting the check box next to the Agent(s) and selecting the Action button Screenshot 2024-08-08 at 4.48.02 PM.png at the top of the screen or by selecting the Action icon Screenshot 2024-08-08 at 4.49.41 PM.png at the right of the page.

  3. Select Disable Agent

    Screenshot 2024-08-08 at 4.51.00 PM.png


This will disable the Agent indefinitely. The Agent must be manually re-enabled before it can resume protecting the selected devices.

Confirming the Agent’s Running State

By default, the Agent runs in the background and automatically protects your machine upon installation. However, if you’d like to confirm that it’s running, you can do so by following one of the procedures below:

By default, the Agent’s UI will not launch. However, the service will still be running and actively protecting your machine whether the UI is running or not.

If the UI is NOT running

  1. Start the Agent UI by following the instructions above under ‘Starting the Agent UI’.

If the UI is running

  1. Navigate to the System Tray at the bottom of the screen and you should see:

    Screenshot 2024-08-13 at 2.59.35 PM.png

    1. The H with the solid dot signifies that the Agent, both service and UI, is up and running.

Updating the Agent

Like all software, regular updates are crucial for fixing bugs, adding new features, and improving client experience and overall security.

threatER strongly recommends using a phased rollout approach when deploying agent updates. This involves updating a few machines at a time, testing them, and then proceeding with additional updates. This standard practice for software updates helps ensure easier troubleshooting and minimizes the risk of widespread issues.

Update via the EnforceDNS Portal

To update agents from the EnforceDNS Portal:

  1. Navigate to the portal, click on Settings> Organization Settings> EnforceDNS Agent> Manage

  2. Select the machine(s) you wish to update

  3. Click on Action

    Screenshot 2024-08-09 at 3.49.01 PM.png


  4. Select Update Agent

    Screenshot 2024-08-09 at 3.49.58 PM.png


  5. Allow up to 15 minutes for the updates to complete.

Uninstalling the Agent

Uninstall via the EnforceDNS Portal

The easiest way to uninstall the Agent is through the ‘Manage’ tab in the EnforceDNS Portal.

  1. Navigate to EnforceDNS> Settings> Organization Settings> EnforceDNS Agent> Manage

  2. From the ‘Manage’ tab, select the machine(s) you wish to uninstall the Agent from, click on ‘Action’ and select ‘Uninstall (vx.x.x)’

  3. The Agent(s) will be uninstalled from the desired machines in about 15 minutes.

Uninstall via Windows

For individual machines, you can also uninstall using Windows.

  1. From the Start menu, select Settings> Apps> Installed apps

  2. Find “HYAS Protect” on the list and click the three dots

  3. Choose “Uninstall” and follow the prompts to fully uninstall EnforceDNS