Ability to lock Level from being uninstalled without approval from Level administrator. See SentinelOne or ThreatLocker as an example.
Follow this request to get an email when its roadmap stage changes.
7 comments
Use the email address associated with your Level account.
This would be easier I'm guessing if Level was an MDM as well as RMM.. But I support the idea.
Originally posted on agent with password against uninstallation
the user even with skills is often not aware of the tools used by us msps, password protecting the agent, demonstrates the presence of the software but also that it is not possible to uninstall it without this password in order to trigger the opening of a ticket in which the reason is then clarified.
Originally posted on agent with password against uninstallation
Level does publish itself to Add or Remove programs, but actually can't be uninstalled from that location. To uninstall Level (as an end-user, aka not from Level dashboard), the user would need to open an administrator PowerShell session and invoke the level binary directly with the --action uninstall flag. We could add extra protections here, but we've not had any reports of users inadvertently removing Level.
Originally posted on agent with password against uninstallation
Thanks, but the procedure you indicated is public, the password remains a choice of the msp and confidential.
My concern for having some kind of tamper protection is more for a bad actor. If I was able to hack a machine my first step would be to gain persistance. Second step, would be to lock out anyone else from admin rights and/or remote access, so I would look for RMM and Remote Control tools to uninstall. A script can be easily written to run common uninstall commands for ScreenConnect, LogmeIn, Datto RMM, etc.... and of course Level.
We are a software development company and we'd have the people with the tech skills to uninstall this product. We are already battling some users that don't want this software to be installed, the password trick would be awesome and give us sysadmins some peace of mind. Also, if possible i'd like some way to know if someone is trying to uninstall it (much like SentinelOne does).
many security software have uninstall password requirements. Seems like it would be straightforward to apply uninstall password or uninstall lock globally or per group. First line of defense is obviously not allowing users local admin rights to machines but thats not always possible.
