Endpoint Security Interoperability

​

What AgenShield installs on Windows

​

How the programs are signed

• A bundled third-party runtime file that already carries its publisher’s valid signature keeps that signature.
• The driver is signed by Microsoft Windows Hardware Compatibility Publisher, through Microsoft’s driver attestation.

Get-ChildItem "$env:ProgramFiles\AgenShield" -Recurse -Include *.exe, *.dll, *.node, *.sys |
  Get-AuthenticodeSignature |
  Select-Object Status, @{ Name = 'Signer'; Expression = { $_.SignerCertificate.Subject } }, Path

​

What AgenShield starts, and why

​

What AgenShield reads

• the AI agents in your organization’s policy catalog;
• programs a process rule in your policy could match, and script interpreters such as Node.js or Python when your policy has process rules;
• programs that start MCP servers, such as npx, uvx, or docker, and the shells and runtimes that host them.

​

Choosing exclusions

1. Identify AgenShield by its signer, not by file hashes. Every AgenShield update changes the hashes, so a hash-based exclusion stops matching at the next update. An exclusion for the Frontegg LTD publisher keeps matching; one pinned to the certificate itself needs updating when it is renewed.
2. A signer exclusion does not cover the Windows tools. powershell.exe, csc.exe, certutil.exe, and logman.exe are signed by Microsoft. Never exclude them globally, or by Microsoft’s certificate: that would exempt every PowerShell session on the device, including an attacker’s.
3. Cover the tools only as children of agenshield-daemon.exe. Where your product offers it, use an exclusion that applies to the AgenShield background service and the processes it starts, or tune the specific detection to that parent. agenshield-daemon.exe starts Windows tools such as those listed above; it does not start AI agents.
4. Never extend a child-process exclusion to agenshield-service.exe or agenshield.exe. Governed agents are started through them. An exclusion that covers their children also covers the AI agents and every program the agents run, which is the activity you most want your security product to see.
5. Scope and review. Apply exclusions to the device groups where AgenShield is installed, use the least permissive option that resolves the problem, and review them when you upgrade either product.

​

Exclusion types to look for

1. A publisher or certificate exclusion for Frontegg LTD. It covers AgenShield’s own programs and keeps matching across updates. Some products need the signing certificate itself, which you can export from a signed AgenShield file:
   $signature = Get-AuthenticodeSignature "$env:ProgramFiles\AgenShield\bin\agenshield-daemon.exe"
   Export-Certificate -Cert $signature.SignerCertificate -FilePath .\Frontegg-LTD.cer
   
2. Tuning of a single detection on an AgenShield helper, created from that detection, with conditions on its parent process (agenshield-daemon.exe) and limited to the device groups where AgenShield is installed. Keep any image name or command line condition as narrow as the detection allows.
3. A path exclusion for agenshield-daemon.exe that also covers its child processes, if helpers are still stopped. Where a product offers several exclusion modes, start with the least permissive one. Use a mode that covers child processes only for agenshield-daemon.exe; see principle 4.

• exclusions that stop a product from monitoring a process and all its descendants;
• antivirus process exclusions for powershell.exe, and any exclusion of the Windows tools by path or by Microsoft’s certificate (principle 2);
• assuming one exclusion covers every engine: in some products an antivirus exclusion applies only to file scanning, not to behavioral detection. Check which part of the product acted before choosing.

​

When a security product interferes

​

Symptoms

• Repeated detections or terminations of powershell.exe or csc.exe whose parent is agenshield-daemon.exe, often classified as suspicious script activity or as an encoded PowerShell command.
• AgenShield files quarantined, or the AgenShield service stopped. Windows restarts the service, so the same detection repeats.

• agenshield status and agenshield doctor show a Host probes warning. There is no such row while everything is healthy, and the warning never names what stopped AgenShield. The same state is included in the device health that AgenShield reports, and in a diagnostic bundle. It has three forms:

  Warning	When it shows	When it clears
  PowerShell probe interpreter repeatedly terminated externally (3 times in 10 min) — process scans and host probes paused, retrying with backoff	Something outside AgenShield stopped its PowerShell three times within 10 minutes	10 minutes after the last stop, once PowerShell has answered again
  PowerShell probe interpreter repeatedly prevented from starting (3 times in 10 min) — process scans and host probes paused, retrying with backoff	Windows refused to start PowerShell three times within 10 minutes	10 minutes after the last refusal, once PowerShell has answered again
  PowerShell probe interpreter not answering (3 failed starts in a row) — process scans paused, retrying with backoff	PowerShell failed to start or answer three times in a row with nothing stopping it, for example when Windows Management Instrumentation hangs	As soon as PowerShell answers again

  The number in the message is the actual count. The last part names what is paused: process scans, host probes, or both.
• While a warning shows, AgenShield waits between attempts, from 30 seconds growing to 5 minutes, and starts at most one PowerShell per attempt. AgenShield’s periodic process checks or host information pause until PowerShell answers again. Newly started AI agents can be recognized late, device details such as hardware or Windows version can show as unknown, and the signed-in user shows as the last one seen for up to 2 minutes and as nobody after that.
• Network inspection can fail to activate when certutil.exe is blocked.
• If the background service itself is stopped or quarantined, the device’s Last sync in the Frontegg Portal stops advancing, and the device moves to Drifted and then Offline; see Devices.

​

Confirm it

1. Run agenshield status or agenshield doctor, and note the time of any Host probes warning.
2. In your security product, open the detections or blocked events from that time, and confirm that the process tree leads to agenshield-daemon.exe or agenshield-service.exe under C:\Program Files\AgenShield\bin, with a Frontegg LTD signer.
3. Apply the narrowest exclusion above. A warning about outside termination clears about 10 minutes after the detections stop, and agenshield status no longer shows it. A not answering warning without matching detections points to a problem on the device itself, such as Windows Management Instrumentation, rather than to your security product.

​

macOS