1. Preserve the alert
Capture the detection name, source engine, time, endpoint, user, parent process, command line, file path, hash, signer, quarantine action, related events, and policy version before restoring or excluding anything.
12 controls · Public CSV · No signup
RMM agent blocked by EDR? Diagnose before you allowlist.
Use this workflow when antivirus, EDR, application control, firewall, or proxy policy blocks or quarantines an approved RMM. Preserve the detection, prove the binary and tenant are expected, reproduce the failure safely, and create only the narrowest temporary exception that restores required function without hiding unauthorized RMM activity.
Download the CSV recordTrace an offline agentOpen the incident runbookReview the primary evidenceInspect the source
First 15 minutes after an RMM block
2. Prove authorization
Match the binary and service to current vendor evidence, then match the tenant or enrollment identity, deployment account, device group, maintenance window, and approved change. A valid signature alone does not prove authorized use.
3. Reproduce safely
Use a bounded test endpoint with the same protection policy. Determine whether the failure comes from antivirus, EDR, application control, attack-surface reduction, firewall, proxy, certificate, or reputation enforcement.
4. Restore deliberately
If the file and activity are verified, restore only through the security product's approved workflow, apply the narrowest temporary control, confirm telemetry remains, and submit the suspected false positive to the security vendor.
Four rules for a safer exception
Verify before allowing
Record where the installer came from, validate its signature and signer, and retain a hash. A familiar filename is not enough.
Scope the real requirement
Prefer exact processes, services, destinations, ports, tenants, and device groups over global path, publisher, or wildcard exclusions.
Test what must stay blocked
Positive tests prove the RMM works. Negative tests prove renamed, relocated, unsigned, wrong-tenant, and non-scoped activity still fails.
Make every exception temporary
Assign an owner, expiry, review triggers, rollback path, and renewal evidence. Remove stale rules when indicators or ownership change.
False positive is a finding, not an assumption
Identify the enforcing control
An antivirus quarantine, EDR alert, ASR block, application-control denial, firewall rule, and proxy decision need different remediation. Record the exact source before choosing a control.
Prefer temporary indicators
Where supported, use a verified file, certificate, destination, tenant, device group, or contextual indicator instead of a global path, extension, process, or publisher exclusion.
Submit the sample
Send the verified file or hash and detection context to the security vendor for analysis. A temporary local exception should not become the permanent substitute for correcting a false detection.
Retest both outcomes
Prove the approved agent installs, updates, checks in, runs bounded work, and opens an authorized session. Then prove an altered, relocated, wrong-tenant, or unapproved artifact remains blocked or alerted.
What the CSV captures
The twelve rows cover scope, source evidence, authenticity, least privilege, network and endpoint controls, tenant boundaries, monitoring, detection tuning, rollback, approval, and recurring review. Each row includes an evidence request and a concrete test.