Local controls on the device

The person who administers a computer can refuse changes from Revo regardless of what the server asks. The switches live in the agent's config.toml, in its protected state directory beside its identity.

The remediation switches

[remediation]
patching        = true   # install updates
reboot          = true   # restart jobs, and restarts after installs
uninstall       = true   # remote uninstall of the agent (agent 0.5.0)
feature_upgrade = true   # Windows version upgrades (agent 0.6.0, Windows only)

Missing settings default to true. If the file can't be read or is invalid, every switch is treated as off; monitoring, security telemetry and signed self-updates carry on.

Revo shows the device as turned off on this device by its local administrator and skips it in deployments and bulk actions.

Fixes (agent 0.8.0 or later)

Agent 0.8.0, available on the beta channel when released, adds switches for fixing with the agent:

[remediation]
fixes        = true                          # catalogue fixes at all
allow        = ["risk:low", "risk:medium"]   # action ids and/or risk groups this device accepts
deny         = []                            # refused; deny wins over allow
dry_run_only = false                         # accept only dry runs
max_seconds  = 900                           # local cap on any fix's run time (10 to 3600)

The defaults refuse high-risk actions (uninstalling an application, turning on ufw) unless the device's owner adds them to allow, for example allow = ["risk:low", "risk:medium", "windows.app.uninstall"]. Fixes the device refuses aren't offered in Revo: the device shows why, with the command that allows it.

Allow app removal

To let Revo uninstall Windows Installer applications on a device (see Uninstalling applications), run this on the device as an administrator, for example from your RMM after installing the agent. It adds windows.app.uninstall to allow with the agent's own settings writer (nothing else changes) and restarts the agent:

& "$env:ProgramW6432\Revo\Agent\revo-agent.exe" configure-remediation --allow-fix=windows.app.uninstall; Restart-Service RevoAgent

The same works for any other action ID or risk group (--allow-fix=linux.ufw.enable on Linux, with sudo /usr/local/lib/revo-agent/revo-agent --state-dir /var/lib/revo-agent configure-remediation and sudo systemctl restart revo-agent). Within a few minutes the device offers the fix in Revo.

Signed-in users (agent 0.9.0 or later)

Agent 0.9.0 reports who is signed in to the device and who signed in last (account and display names only). To turn that off on a device:

[privacy]
report_users = false

or install with -NoUserReport (Windows script) or --no-user-report (Linux and macOS). Revo then shows Turned off on this device. An invalid [privacy] section turns reporting off too.

Where the file is

After editing, restart the agent service:

Restart-Service RevoAgent

# Linux
sudo systemctl restart revo-agent
# macOS
sudo launchctl kickstart -k system/com.revotg.agent

Set them at install time

Re-installing or upgrading keeps existing false values.

Other server-side controls

The local switches are the last of three gates. Patch installs and restarts also need patch management turned on for the customer, and the workspace not paused. See How patch management works.

[remediation]
patching        = false  # no update installs (and no Windows upgrades)
reboot          = false  # no restarts
feature_upgrade = false  # no Windows version upgrades
fixes           = false  # no catalogue fixes (agent 0.8.0 or later)
uninstall       = false  # optional: also refuse remote removal of the agent

uninstall controls removing the agent itself, not changes to the device, so leave it true if the MSP should still be able to retire the agent remotely. On the Windows EXE and macOS installers the same result is --disable-patching --disable-reboot --disable-feature-upgrade --disable-fixes (add --disable-remote-uninstall if wanted; the macOS installer has no --disable-feature-upgrade, since upgrades are Windows-only).