Service Management
This guide explains how the agent stays healthy on the endpoint - the service model, tamper resistance, offline behaviour, and how it keeps itself current.
Protection service
The agent runs as a single Windows service, CtrlOneProtectionService, with supervised session helpers. Windows service recovery restarts the service after a failure, so the agent keeps enforcing policy and checking in after crashes or restarts.
Tamper resistance
The agent is built to resist local tampering - registry protections and service hardening make it difficult for a standard user to disable enforcement. This is why removal requires the uninstall credential when one is set.
Signed offline cache
Restrictions don't depend on a live connection to the console. The agent keeps enforcing its authenticated cached restrictions while offline, so a device that loses connectivity keeps applying its last signed policy.
Staying current
The agent can apply approved updates, with verification and recovery outcomes recorded, so your fleet stays on a current build without manual reinstalls. The desktop Agent Console updates separately - see the upgrade guide for how the two differ.
Frequently asked questions
What happens if a device goes offline?
It keeps enforcing its authenticated cached policy. License expiry and isolation are separate, recorded states.
Can a user just stop the service?
The agent is tamper-resistant, with service recovery and registry protections that make casual disabling difficult. Removal requires the uninstall credential when set.
Do I have to update agents manually?
No. The agent can apply approved updates, with outcomes recorded. The desktop Agent Console is updated through its own separate download.
Something not behaving?
The troubleshooting guide walks through check-in failures, restrictions that don't apply, and console connectivity.