You may sometimes notice unidentified agents added to your console. This usually happens after you shared the agent's installer download link with your customers.
Cause
This kind of unfamiliar device appears after a third-party software/provider/antivirus accesses your Agent download URL and attempts to install it to ensure it is not malicious.
As an example, you can take your agent's share URL and put it in a URL Shortener tool to shorten it. The first step would be for the tool to try to run the installer in order to check it for malicious content. After it installs it and confirms that it is clean, the tool removes the agent and then provides you with the short URL.
Effect
As a result, an unknown device appears in your Atera dashboard. Those devices are not actual machines but rather Virtual Machines.
These sandbox installation attempts can also send OTP (one-time password) verification emails to your technicians.
Usually, these machines go offline very quickly because the software is not malicious; hence, there is no need to keep it on the local machine.
As an example, such machines are from HP with a Memory of 1GB.
Therefore, you can simply delete these unknown devices, which should not appear again.
Note: Please rest assured that this does not represent a security issue. You, as the MSP, have full access to the machine, not vice versa.
Review new agents before they join your account
To keep these devices out of your console, turn on the Agent Approval Queue. It holds newly registered agents in a staging queue, so you can approve or reject each one before it joins your account. This is especially useful for filtering out devices created by antivirus or EDR tools that scan your installer in a sandboxed environment. The feature is opt-in and off by default.
Whitelist AteraAgent in Sandbox
If you see more 'Unfamiliar Devices' in Atera, check your Antivirus (AV) settings. To fix this, use the thumbprint value to whitelist the Atera agent in your AV's Sandboxing feature.
General Steps
-
Locate the Thumbprint Value:
- You can find the Thumbprint in the certificate details of the installer file.
-
Whitelist in Sandboxing:
- Access your AV's settings and navigate to the Sandboxing or Application Control section.
- Add the Thumbprint value of the Atera agent installer as a trusted source.
Additional Notes
- This approach works across various AV solutions that support whitelisting by certificate thumbprint.
- Due to differences between AV products, specific instructions for each AV cannot be provided in this article. Please refer to your AV’s documentation for detailed steps.
- For the Atera paths, processes, and certificates to exclude, and steps for common security tools, see Whitelist Atera in your antivirus and other security programs.
