Skip to main content
Red Canary help

SentinelOne macOS Agent is Reporting "Pending Actions: Unprotected Agent"

  • Updated .

Issue

The SentinelOne macOS Agent is showing "Pending Action: Unprotected Agent" in the SentinelOne Management console.  

Environment

SentinelOne

Resolution

Enable Anti-Tampering for the Agent.  Anti-Tampering protects the Agent from unauthorized changes or uninstall.  Make sure that it is enabled in the policy of the Agent.  If it is already enabled in the policy, it is probably disabled in the Agent's local configuration.

To enable Anti-Tampering on the local Agent run the following command from the terminal: 

sudo sentinelctl protect
 
Example: 
mceclip0.png
 

Cause

he Agent is unprotected because Anti-tampering is disabled or the OS protection tools are off.