Purpose

When ThreatLocker is used within a Customer's environment, and it is setup to prevent malicious activity, the installation and update of the Quickpass Agent can be affected.

To ensure proper monitoring during the installation and update process, ThreatLocker has provided the following implementation steps.

Background

Using the Scripted installation method of installing the agent via these KBs, can cause ThreatLocker to incorrectly detect and block the Quickpass Agent from installing.

RMM Installation - https://support.getquickpass.com/hc/en-us/sections/18745885825815-RMM-Monitoring-of-CyberQP

Scripted installation - https://support.getquickpass.com/hc/en-us/articles/4413576799639-Scripted-Agent-Installation

Prebuilt PowerShell Scripts - https://support.getquickpass.com/hc/en-us/articles/4414062591639-PowerShell-Script-for-Agent-Installation

In addition, updates of the Agent may fail when automatically released by CyberQP if the "built-in Policy" is not in use.  You can supplement your existing policies by ensuring the "built-in" from ThreatLocker is in place.

Process

1. Enabling RingFence rules:

   1. Open Modules
   2. Click Application Control from the left-hand menu. Navigate to the Policies tab in the top right.
   3. Locate the Powershell policy which is ringfencing these machines.
      1. By default, this will be at the Computer Group level, but this is configurable and you may have moved it within your own environment.
   4. Click on the policy to open the Edit Application Policy slideout.
   5. Scroll down to the Actions section and find the subsection "Restrict this application from accessing the internet?". This will be enabled and the Exclusions tab will be selected by default.
      
   6. Switch to the Tags tab. In the Tag dropdown, search for QuickPass to find "ThreatLocker\Quickpass (built-in)"
   7. Click the blue + icon to add the tag, then click the save button at the bottom of the slideout menu.
      
   8. Deploy policies using the rocketship button in the top right of the screen
      
      
      

2. Adding Quickpass "Built-in Policy" to Organization

   1. 1. Select Modules > Application Control > Policies to view the policies for your organization. Set the "Applies to" level to whichever level your policy exists at, then click the policy to open the Edit Application Control Policy slideout.
         
         
      2. In this slideout, locate the Conditions section. This will be set to Selected Applications and will have the applications controlled by this policy visible in the box below. Search for "Quickpass" to find "BUILT-IN\Quickpass (Built-in)". Any Application prefixed with BUILT-IN\ is maintained by ThreatLocker's Applications team for updates.
         
         
      3. Save the policy change, then deploy policies using the Rocket Ship icon in the top right of the main page.
         
         
         

Troubleshooting