Fix with the agent

RevoAgent can fix a set of common security problems it already detects: Microsoft Defender's real-time protection off, the firewall off, SMBv1 on or SMB signing not required, a weak local password policy, a security product's service stopped, an application you want gone, and similar. Each fix is one action from a fixed catalogue built into the agent. RevoSecure never sends scripts or commands.

Before you start

1. Turn remediation on for the customer. Customer settings → Remediation, then switch on Agent remediation. It's off by default. Turning it on needs an owner or admin with two-factor authentication.
2. Choose the actions. Low- and medium-risk actions are allowed by default; high-risk ones (uninstalling an application, turning on a Linux server's firewall) are off until you allow them. The policy also shows who can run each one (see Who can run a fix).
3. Check the device's own settings. The device's administrator has the final say: the agent's local [remediation] settings can switch fixes off, allow only dry runs, or refuse actions. High-risk actions are refused on the device unless its owner allowed them when installing the agent (see Local controls on the device).

Fix a finding or a device

• On a finding that the agent can fix, the finding page says RevoSecure can fix this on the device and lists the action with its risk.
• On a device, the Fix with the agent section lists fixes for its open findings first, then hardening and diagnostics actions (screen lock, Guest account, DNS cache, a diagnostics bundle).

Choose Fix with agent. One dialog lets you choose the options, shows exactly what will happen, and starts the fix when you confirm. There is no approval step. You can:

• run a Dry run: the agent checks the preconditions and reports what it would change, without changing anything;
• run it as soon as the device is online, or in the device's next maintenance window (its patch policy's window). Disruptive actions default to the window and need a written reason to run outside it;
• add a reason, kept with the run and in the audit log.

What will happen is worked out by RevoSecure from the device as it is now: each device and when it runs (or why it won't), the exact arguments signed into the job, how to undo it, and, in amber, what people using the device may notice (a restart, a removed application, connections or Remote Desktop clients that stop working, a session that locks). The button says what it does: Run fix now, Schedule fix or Run dry run.

If something changes before you press it (the device drops out, its maintenance window moves), RevoSecure doesn't run the old version: the dialog shows the new one and asks you to check it again.

A device that can't take the action (older agent, wrong platform, switched off locally, already running the same fix, rate limit) is skipped with the reason; the others go ahead.

Who can run a fix

Disruptive actions (uninstalling an application, turning on ufw, removing the SMB 1.0 feature, requiring SMB signing for the device's own outgoing connections) are treated like high-risk ones.

High-risk and disruptive fixes need three things from the owner or admin who starts them:

1. Two-factor authentication on this sign-in. Having it turned on for your account isn't enough on its own: the session must have signed in with a code. If it didn't (for example you turned two-factor authentication on after signing in on that browser), Revo asks for a code from your authenticator app once and then remembers it for that session. The same applies to turning remediation or an action on.
2. The exact preview. The fix runs only as shown in the dialog. If anything changed, you check it again.
3. The device count, typed. You type the number of devices it changes to confirm, so a high-risk fix can't be started with a stray click.

API keys can never run high-risk or disruptive fixes. Technicians (and API keys) can still run a dry run of one: it changes nothing.

If the person who started it is no longer an owner or admin. A high-risk fix scheduled for a later maintenance window is sent only while the person who started it is still an owner or admin with two-factor authentication. If they're demoted, deactivated or their two-factor authentication is reset before the device picks it up, the fix isn't sent and the run shows why.

When the rules change after you start a fix. Turning remediation or the action off for the customer cancels its scheduled fixes, and jobs already signed for them are withdrawn. If a device's maintenance window moves, its fix waits for the new window instead of running at the old time. Archiving a customer or suspending the workspace cancels scheduled fixes too. Every run shows who started it, and the audit log records it as remediation.run_started.

When a fix can't run

Most findings from the agent's checks also have manual steps on the finding page and its quick look: exactly what is wrong ("SMBv1 is turned on", "Minimum password length is 7 (needs 14)", "Windows Firewall is off for the Public profile"), the PowerShell or shell commands with copy buttons, the Group Policy and Intune settings that fix it on every device at once, and what to check before changing it. They're there whether or not the agent can do it for you: on an older agent, a device that doesn't allow the fix, or a customer without remediation, the fix row says why.

SMB signing and the password policy (agent 0.9.0)

• Require SMB signing makes connections to the device's shares signed, so a sign-in can't be relayed to them. It rarely breaks anything: every supported client signs. The option to also require signing for the device's own connections can stop it reaching old NAS units, copiers and printers that can't sign, so it's owner/admin only and defaults to the maintenance window. RevoSecure's check only needs the first part.
• Set the local password and lockout policy sets a minimum length (8 to 14, default 14) and account lockout (after 3 to 10 wrong passwords, default 10, for 5 to 60 minutes). It never weakens a stricter value, and restores the previous one if it can't verify the change. Domain controllers and Active Directory members refuse it with Managed by policy: their policy comes from the domain's Default Domain Policy, which the finding's manual steps explain how to change.

Uninstalling applications

On a Windows device's Software tab, Uninstall appears next to every application installed for the whole device with a Windows Installer (MSI) package, for example the classic Teams Machine-Wide Installer or Microsoft Silverlight (both also raise an unsupported software finding). The agent removes it by its product code, only if its name and version still match what RevoSecure saw.

• Several devices at once. The dialog lists the customer's other devices with the same application and version: tick them to remove it from all of them in one run, with one confirmation.
• Can't remove remotely. Apps whose uninstaller isn't Windows Installer, hidden Windows components and per-user installs aren't offered. Running an app's own uninstall command as SYSTEM would let whoever installed the app run anything on the device, so RevoSecure doesn't. Remove those on the device, with your RMM or with Intune.
• Protected. Security, remote-access, backup and runtime software (Visual C++, .NET, WebView2) and RevoAgent are never removed.
• The device must allow it. Uninstalling is high-risk, so the agent refuses it until the device's owner allows it. The Software tab shows the one-line command to run on the device (see Allow app removal), and the customer's remediation settings must allow Uninstall an application. Only owners and admins can start an uninstall; it defaults to the maintenance window and may need a restart to finish (RevoSecure never restarts the device for it).

Results and verification

Agent fixes (in the sidebar under Respond) lists every run, in the portfolio or for one customer. A run's page shows each device's status and outcome:

Each device's before and after state is shown. A verified fix doesn't close the finding on the agent's word: it notes the fix on the finding and asks the device for fresh data, and the finding resolves on the next evaluation if the problem is really gone. If an action needs a restart, the device shows Restart pending; the agent never restarts a device for a fix.

Limits

• Only the actions in the catalogue. There are no scripts, commands or custom actions.
• No action turns a protection off.
• Rate limits: 30 runs per person per hour, 1,000 device actions per workspace per hour, three changes of the same action per device per day, 200 devices per run.
• Turning remediation or an action off cancels its scheduled work. A device already running the action finishes it, and its result is still recorded.

See Remediation for what Revo changes on customer systems overall.