App Control: How to Stop/Start the Agent via Command Line (macOS)

[#1]

Environment

• App Control Agent: All Supported Versions
• macOS: All Supported Versions

Objective

To completely stop/start the App Control Agent for testing purposes.

Resolution

Disable Agent:

1. Use Terminal to issue the following commands:

   cd /Applications/Bit9/Tools 
   ./b9cli --password 'GlobalCLIPassword'
   ./b9cli --shutdown
   sudo launchctl unload /Library/LaunchDaemons/com.bit9.Daemon.plist

2. Perform testing.
   • NOTE: When the Agent is not running it will be unable to monitor the creation of new files.
   • Any File Creation Control Rule will not be able to properly issue Local Approvals and may cause issues in execution once the Agent is enabled again.

Enable Agent:

1. Use Terminal to issue the following commands:

   sudo launchctl load /Library/LaunchDaemons/com.bit9.Daemon.plist
   ./b9cli --status

2. Verify the Agent shows as Connected with Tamper Protection Enabled.

Additional Notes

Running the commands in Step 1 to disable the Agent will do the following:

• Prevent the Agent from communicating with the App Control Server
• Prevent the Agent from tracking any file operations
• Prevent the Agent from taking any actions
• Allow the Agent to be uninstalled

Related Content

App Control: What Happens When Moving Agents in and Out of Disabled Policies?
App Control: How to Disable/Enable Tamper Protection
App Control: How To Collect Agent Performance Logs on macOS (Locally)
App Control: How To Use B9cli Command (macOS)