Skip to main content

​
Anti-tamper that actually holds against the local administrator

Every endpoint monitoring product faces the same hard problem: the people you’re monitoring sometimes have local administrator rights on the endpoints you’re monitoring them on. Contractors with sysadmin scope. Engineers on their own machines. Power users with elevated privileges granted for legitimate work. The threat model isn’t malware - it’s the knowing user with admin rights who wants to disable monitoring. Syteca’s Protected Mode runs the Windows Client agent with kernel-driver-level protection. The user can’t edit Client log files, modify Client settings in the registry, or edit/remove/modify/rename the Client’s .exe and .dll files - even with full local administrator privileges. The protection sits below user mode, enforced by the driver. Same product, same agent, same Management Tool - just a checkbox to enable enhanced mode.
Use Protected Mode when you need to:
  • Monitor users with local administrator rights - contractors, engineers, IT staff, power users - without those rights letting them disable monitoring.
  • Harden VDI and terminal-server deployments where multiple users with elevated rights share Client machines.
  • Meet compliance requirements that demand demonstrably tamper-resistant monitoring (some PCI DSS, ISO 27001, SOC 2 controls).
  • Reduce the insider-threat blast radius - Protected Mode makes it dramatically harder for a determined user to evade monitoring than user-mode-only alternatives.
Applies to Windows Clients only. Protected Mode is implemented at the Windows kernel driver level. macOS and Linux Clients don’t have an equivalent feature.

​
What Protected Mode prevents

When a Windows Client operates in Protected mode, the user - even with local administrator rights - cannot: The two operating modes:

​
When the change takes effect

The activation pattern depends on when Protected Mode is enabled: This reboot requirement is a side effect of the driver-level implementation - the driver needs to load at boot time to enforce protection.

​
Enabling Protected Mode

1

Open the Client

In the Management Tool, click Clients, then click the Windows Client’s name in the Client Name column.
2

Open Client Mode

On the Editing Client / Editing Client Group page, on the Properties tab, scroll to the Client Mode section.
3

Select Enable Protected mode

Check the Enable Protected mode checkbox.
4

Save and reboot

Click Finish. Then reboot the Client computer for the driver to load and the protection to take effect.
Enabling Protected Mode during installation instead of post-deployment avoids the reboot requirement. Plan for it during your rollout playbook - bake Protected Mode into the Client installer for any deployment targeting endpoints where adversarial monitoring is a concern.

​
Operational implications

A Client operating in Protected Mode cannot be reconnected to a different Application Server. The driver-level protection extends to the Application Server binding configuration. If you need to point a Client at a different Application Server, you must either:
  1. Uninstall the Client locally (and reinstall pointing at the new Application Server), or
  2. Change the Client to Non-Protected mode first, reconnect, then re-enable Protected mode if needed.
Plan Application Server migrations with this in mind - Protected-Mode Clients require explicit migration handling.

​
Supported platforms

Protected Mode is supported on Windows Client machines running:
  • Windows 11
  • Windows 10
  • Windows Server 2022
  • Windows Server 2019
  • Windows Server 2016
Other Windows versions (e.g. Windows 7, Windows Server 2012) do not support Protected Mode - the driver is only validated against the platforms listed above.

Windows Clients

Full Windows Client documentation - installation, OS support, advanced configuration.

Recording indicators

User-visible monitoring notifications - complementary to Protected Mode’s invisible protection.

Update Client automatically

Auto-update interacts with Protected Mode - both are in the Client Mode section.

Reconnecting Clients

Reconnection procedure (and why Protected Mode requires special handling).