> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Protected Mode

> Run the Syteca Windows Client in Protected mode - kernel-driver-enforced anti-tamper protection preventing users from editing Client data, settings, log files, or binaries even with local administrator rights.

## Anti-tamper that actually holds against the local administrator

Every endpoint monitoring product faces the same hard problem: the people you're monitoring sometimes have local administrator rights on the endpoints you're monitoring them on. Contractors with sysadmin scope. Engineers on their own machines. Power users with elevated privileges granted for legitimate work. The threat model isn't malware - it's the **knowing user with admin rights who wants to disable monitoring**.

**Syteca's Protected Mode runs the Windows Client agent with kernel-driver-level protection**. The user can't edit Client log files, modify Client settings in the registry, or edit/remove/modify/rename the Client's `.exe` and `.dll` files - even with full local administrator privileges. The protection sits below user mode, enforced by the driver. Same product, same agent, same Management Tool - just a checkbox to enable enhanced mode.

<Info>
  **Use Protected Mode when you need to:**

  * **Monitor users with local administrator rights** - contractors, engineers, IT staff, power users - without those rights letting them disable monitoring.
  * **Harden VDI and terminal-server deployments** where multiple users with elevated rights share Client machines.
  * **Meet compliance requirements** that demand demonstrably tamper-resistant monitoring (some PCI DSS, ISO 27001, SOC 2 controls).
  * **Reduce the insider-threat blast radius** - Protected Mode makes it dramatically harder for a determined user to evade monitoring than user-mode-only alternatives.
</Info>

<Warning>
  **Applies to Windows Clients only.** Protected Mode is implemented at the **Windows kernel driver** level. macOS and Linux Clients don't have an equivalent feature.
</Warning>

## What Protected Mode prevents

When a Windows Client operates in **Protected mode**, the user - **even with local administrator rights** - cannot:

| Action                                                             | Why blocked                                                                                                    |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| **Edit Client log files**                                          | Log files protected by the driver from read/write/delete by user-mode processes (other than the Client itself) |
| **Edit Client screen captures generated locally**                  | Same protection applied to the screen capture cache on disk                                                    |
| **Edit Client settings in the Registry**                           | Registry keys protected by the driver from user-mode modification                                              |
| **Edit, remove, modify, or rename Client `.exe` and `.dll` files** | Binary file protection - the user can't even rename the agent to break its operation                           |

The two operating modes:

| Mode              | Description                                                                                                                                                   |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Non-Protected** | Regular Client operation. No enhanced protection. Suitable for endpoints where users don't have admin rights or where adversarial monitoring isn't a concern. |
| **Protected**     | Driver-level anti-tamper protection. Suitable for any deployment where users with admin rights are being monitored.                                           |

## When the change takes effect

The activation pattern depends on **when** Protected Mode is enabled:

| When enabled                                     | When the change takes effect              |
| ------------------------------------------------ | ----------------------------------------- |
| **During Client installation**                   | Immediately                               |
| **During Client editing** *(after installation)* | After the Client computer is **rebooted** |

This reboot requirement is a side effect of the driver-level implementation - the driver needs to load at boot time to enforce protection.

## Enabling Protected Mode

<Steps>
  <Step title="Open the Client">
    In the Management Tool, click **Clients**, then click the Windows Client's name in the Client Name column.
  </Step>

  <Step title="Open Client Mode">
    On the **Editing Client** / **Editing Client Group** page, on the **Properties** tab, scroll to the **Client Mode** section.
  </Step>

  <Step title="Select Enable Protected mode">
    Check the **Enable Protected mode** checkbox.
  </Step>

  <Step title="Save and reboot">
    Click **Finish**. Then **reboot the Client computer** for the driver to load and the protection to take effect.
  </Step>
</Steps>

<Tip>
  **Enabling Protected Mode during installation** instead of post-deployment avoids the reboot requirement. Plan for it during your rollout playbook - bake Protected Mode into the Client installer for any deployment targeting endpoints where adversarial monitoring is a concern.
</Tip>

## Operational implications

<Warning>
  **A Client operating in Protected Mode cannot be reconnected to a different Application Server.** The driver-level protection extends to the Application Server binding configuration. If you need to point a Client at a different Application Server, you must either:

  1. **Uninstall the Client locally** (and reinstall pointing at the new Application Server), or
  2. **Change the Client to Non-Protected mode** first, reconnect, then re-enable Protected mode if needed.

  Plan Application Server migrations with this in mind - Protected-Mode Clients require explicit migration handling.
</Warning>

## Supported platforms

Protected Mode is supported on Windows Client machines running:

* Windows 11
* Windows 10
* Windows Server 2022
* Windows Server 2019
* Windows Server 2016

Other Windows versions (e.g. Windows 7, Windows Server 2012) do **not** support Protected Mode - the driver is only validated against the platforms listed above.

## Related

<CardGroup cols={2}>
  <Card title="Windows Clients" icon="laptop" href="/docs/administration/clients/windows">
    Full Windows Client documentation - installation, OS support, advanced configuration.
  </Card>

  <Card title="Recording indicators" icon="eye" href="/docs/session-monitoring/recording/recording-indicators">
    User-visible monitoring notifications - complementary to Protected Mode's invisible protection.
  </Card>

  <Card title="Update Client automatically" icon="refresh-ccw" href="/docs/administration/clients/parameters/update-client-automatically">
    Auto-update interacts with Protected Mode - both are in the Client Mode section.
  </Card>

  <Card title="Reconnecting Clients" icon="arrow-right-left" href="/docs/resources/troubleshooting/client-troubleshooting#reconnect-windows-clients-to-a-different-application-server">
    Reconnection procedure (and why Protected Mode requires special handling).
  </Card>
</CardGroup>