You may sometimes notice unknown agents added to your console. This usually happens after you shared the agent's installer download link with your customers. 

Cause

This kind of Rogue machine appears after a third-party software/provider/Antivirus accessed your Agent download URL and tried to install it to ensure it is not malicious.

As an example, you can take your agent's share URL and put it in a URL Shortener tool to shorten it. The first step would be for the tool to try and run the installer, in order to check it for malicious content. After it installs it and confirms that it is clean, the tool removes the agent and then provides you with the short URL.

Effect

As a result, an unknown device appears in your Atera dashboard. Those devices are not actual machines but rather Virtual Machines.

Usually, these machines go offline very quickly, because the software is not malicious, hence there is no need to keep it on the local machine.

As an example, such machines are from HP with a Memory of 1GB. 

Therefore, you can simply delete these rogue Devices which should not appear again.

Note: Please rest assured that this does not represent a security issue. You as the MSP have full access to the machine and not vice-versa. 

Whiteliste AteraAgent in Sandbox

If you're seeing more 'Rogue Devices' in Atera, check your Antivirus (AV) settings. To fix this, whitelist the Atera agent in your AV's Sandboxing feature using the Thumbprint value.

General Steps

1. Locate the Thumbprint Value:

   • You can find the Thumbprint in the certificate details of the installer file.

2. Whitelist in Sandboxing:

   • Access your AV's settings and navigate to the Sandboxing or Application Control section.
   • Add the Thumbprint value of the Atera agent installer as a trusted source.

Additional Notes

• This approach works across various AV solutions that support whitelisting by certificate thumbprint.
• Due to differences between AV products, specific instructions for each AV cannot be provided in this article. Please refer to your AV’s documentation for detailed steps.