App Control: Why are users with admin rights to a computer able to stop the agent service locally with tamper protection enabled in the console?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why are users with admin rights to a computer able to stop the agent service locally with tamper protection enabled in the console?

Environment

• App Control: All supported versions

Resolution

One possible and highly likely scenario is in the past the agent config to allow agent upgrades was enabled

Additional Information

• To disable navigate to agent_config.php set filter to 'value' locate the config 'Allow Agent Upgrades' and set to Disabled. 
• This setting should only be enabled when an upgrade cycle is to begin and disabled upon completion