Anti-Tamper Protection

Anti-tamper protection stops the forwarder being modified or removed without authorization. It resists attempts to stop it, uninstall it, or alter its files, so collection continues even on an endpoint an adversary has reached.

That is the point, and it is also why an ordinary uninstall does not simply work. The forwarder cannot distinguish your removal from an attacker's, so it refuses both until something proves the request came from your console.

When would I turn it off?

Three legitimate reasons, all temporary:

• Updating the forwarder out of band, meaning outside the Stairwell console. See Update the macOS Forwarder.
• Removing the forwarder. See Uninstall the macOS Forwarder.
• Troubleshooting, occasionally, when support asks.

Note that updating from the console needs none of this. Pushing an update from Stairwell handles the protection itself, which is the main practical argument for that route over an MDM policy.

How do I suspend it?

With a maintenance token, which is what proves authorization.

1. Generate a Forwarder Maintenance Token in the console. See Asset Identifiers.
2. Use it to put the forwarder into maintenance mode.
3. Anti-tamper is suspended, and the update or uninstall can proceed.

Two properties of the token shape everything here. It is scoped to one environment, so a token from the wrong environment fails in a way that reads like a bad token rather than the wrong one. And it expires after 14 days, which matters most when the token is baked into an MDM policy for a staged rollout that runs longer than that.

Stairwell provides the detailed platform-specific procedures for macOS and Windows to verified customers on request. Contact your Stairwell representative or [email protected].

How does it come back on?

By itself, in both of the normal cases:

• A new forwarder version is installed and starts normally.
• The maintenance token expires, after 14 days.

There is no manual re-enable step. If you suspended it for troubleshooting, reinstalling or restarting the forwarder restores it.

So the failure mode is not leaving protection off forever, it is a window. A machine in maintenance mode is a machine whose forwarder can be stopped, and it stays that way until one of the two events above. Do the work and finish, rather than putting a fleet into maintenance mode and coming back tomorrow.

What should I read next?

• Uninstall the macOS Forwarder, the most common reason to suspend it.
• Update the macOS Forwarder, including the console route that avoids this entirely.
• Asset Identifiers, for the maintenance token.