- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
Command line tool to stop, start or perform actions on Sentinel One agent
04/08/2022 
7 People found this article helpful
85,064 Views
Description
SentinelCtl.exe is a command line tool that can be used to executes actions on Agent on a Windows endpoint. This can be typically used to unprotect, unload/disable, load/re-enable, protect agent on your devices. We recommend that you do not use this for any other purpose unless Support suggests.
Press the Windows Start key.
Enter: cmd
Right-click Command Prompt and select Run as administrator.
Go to the [C:\Program Files\SentinelOne\Sentinel Agent <Version>]
To run the tool: SentinelCtl.exe <command> [options]
To see all options of a command: SentinelCtl.exe <command> -help
Resolution
Useful commands are as follows:-
> SentinelCtl.exe unprotect -k <S1 Passphrase>
This disables the anti-tampering. Please refer to end of the article on how to obtain S1 Passphrase.
> SentinelCtl.exe unload -m -a
This Stops the Agent services
> SentinelCtl.exe load -m -a
This Starts Agent services.
> SentinelCtl.exe protect
Set Anti-Tampering. Protects the Agent from unauthorized changes or uninstall.
> sentinelctl unquarantine_net -k <S1 Passphrase>
Connect a disconnected endpoint (remove network quarantine).
> SentinelCtl.exe reload -m -a
Stop and then start the Agent services.
> SentinelCtl.exe is_scan_in_progress
To check if Full Disk Scan is in progress.
Return: Full disk scan in progress: with a value of True or False
> SentinelCtl.exe scan_folder -i path
To scan on a folder
Options:
-i, --infile
Folder to scan. If you do not use this parameter, the complete drive is scanned.
> SentinelCtl.exe is_scan_in_progress
To see if full disk scan is in progress
Returns: Full disk scan in progress: with a value of True or False
> SentinelCtl.exe status
To get the status of Agent services and policy basics.
Notes
Mitigation policy: none - The Agent does not enforce policy with mitigation.
Mitigation policy: quarantineThreat - The Agent enforces policy with kill and quarantine mitigation.
> SentinelCtl.exe ever_connected_to_management
Use this to check if S1 agent ever connected to management
Sample output
Mgmt key part: 4ba007899be132d45a1590ds4f2ff2f2f031c4ffa3
This command requires admin privileges (Run as Administrator) but does not require a passphrase.
> SentinelCtl.exe ie_protection [-e|-d] -k "<passphrase>"
This can be used to Enable or Disable IE protection. Requires reboot to apply.
Options:
-e, --enable
Enable IE protection.
-d, --disable
Disable IE protection.
> SentinelCtl.exe config agent.wscRegistration {1 | 0 } -k "<passphrase>"
Use this command to disable Windows Security Center (WSC). It is not recommended to disable WSC. By default, the SentinelOne Windows Agent registers with WSC as anti-virus protection and Windows Defender is disabled.
Please note, S1 Passphrase can be obtained by Capture Client admin (from management console) for the device. Go to "Devices" section and download devices list. Look for "S1 Passphrase" for the respective device in the downloaded list. Screenshots provided below for reference.
Related Articles
- How to upgrade a Single Endpoint Manually from the Capture Client Console.
- Capture client Mac installation - S1 not enforcing security
- Uninstalling SentinelOne MAC Agent through Recovery Mode
YES
NO