ThreatLocker Agent Tray

Overview 

The ThreatLocker tray allows you to:

• View Blocked Items
• Override Codes
• Reset History
• Generate Rapid Check-ins
• View Realtime Unified Audit
• Check Maintenance Modes within the Mobile App

Blocked Items

Right-clicking on the ThreatLocker tray icon and clicking 'Blocked Items' will allow you to see all blocked items in the tray, whether they are hidden or not.

A new request permission screen allows the user to enter an email address for the reply to go to and a reason they want the new software.

Override

Right-clicking on the ThreatLocker tray icon and clicking on 'Override' will produce a popup window where you can enter your override code. On ThreatLocker Version 7.6 and above, Override Codes allow you to disable Application Control and Tamper Protection blocking on a computer that does not have access to the internet or the ThreatLocker Data Centers. On ThreatLocker Version 8.2 and above, you are also able to disable Network Control. 

Machines on ThreatLocker Versions 7.6 and newer have Override Codes by default. Admins can run the report "Override Codes (Agent 7.6 or above)" to see the unique override code linked to each hostname. These unique codes are automatically regenerated every day per computer you have installed in the portal. The most recent code registered for a machine is based on its most recent check-in. If a machine is offline for more than 24 hours, the code will regenerate upon the next check-in. For more information about Override Codes, please refer to the ThreatLocker Override Codes KB article.

Reset History

Right-clicking on the ThreatLocker tray icon and clicking on 'Reset History' will cause previous requests or ignored files to be forgotten. If an ignored or requested file is blocked again, you will receive a notification. You must select 'Yes' or 'No' on the Forget Previous Notifications popup to verify this reset.

Rapid Check-in

Right-clicking on the ThreatLocker tray icon and selecting 'Rapid Check-in' will enable check-in from the ThreatLocker Tray. This means the agent will begin checking into the ThreatLocker Portal every 5 seconds for 5 minutes starting the next time the agent checks into the ThreatLocker Portal.

Realtime Unified Audit

Right-clicking on the ThreatLocker tray icon and clicking on 'Realtime Unified Audit' will produce a window where you can view the Realtime Unified Audit for your machine. 

Maintenance Mode

Right-clicking on the ThreatLocker tray icon and clicking on 'Maintenance Mode' will display a QR code that can be scanned with a Mobile Application's QR Scanner or a device's native camera. For more information about ThreatLocker Mobile App, please refer to the ThreatLocker Mobile App course in ThreatLocker University. 

Scanning the QR code will allow you to manage the specific computer quickly within the mobile application's Computers page.