Working with SecureConnector

You can use SecureConnector to access Windows endpoints and make them manageable for deep inspection. In general, Windows endpoints are unmanageable if their remote registry or file system cannot be accessed. This is typical for:

• Machines that are guests on the network
• Endpoints that are not part of the domain

Several policy properties are available for detecting unmanageable endpoints.

SecureConnector is required to perform the following actions on endpoints:

• Assign to VLAN behind VoIP devices without resetting port
• Disable External Device
• Disable Dual Homed
• Send Balloon Notification when the SecureConnector systray icon is visible on the endpoint

SecureConnector improves kill frequency when working with the following actions:

• Kill Cloud Storage on Windows
• Kill Instant Messaging on Windows
• Kill Peer-to-peer on Windows
• Kill Process on Windows

  These actions detect and halt specific Windows processes. If SecureConnector is installed on the endpoint, the actions run once per second; if not, the actions run once per minute.

SecureConnector creates a secure (encrypted TLS) connection to the Appliance through port 10003. SecureConnector receives inspection and action requests and responds to them via this connection. All Forescout traffic between SecureConnector and the Appliance takes place over the secure connection.

When an endpoint is reassigned to another Appliance, the secure connection is seamlessly re-created between the endpoint and the newly assigned Appliance. This is sometimes referred to as "HPS redirect".

You can configure SecureConnector to run once and terminate itself upon user logout, reboot, or disconnection from the network, and then reopen at reconnection to the network and readmission to the relevant policy. This is called dissolvable installation.

Alternatively, it can be configured to install permanently so that it remains at reboot or disconnection.

When SecureConnector is installed on a host, it continuously monitors host properties and only reports changes. Event driven monitoring significantly reduces network traffic and provides the most updated information without policy rechecks.

The host properties updated using event-driven monitoring are listed in Remote Inspection and SecureConnector – Feature Support.

The HPS Inspection Engine Plugin provides SecureConnector IPv6 support for Windows endpoints. IPv6 for SecureConnector is automatically enabled, and no configuration is required. However, you can choose your IP preferences. High Availability Appliances are also supported.

Requirements for IPv6:

• HPS Agent Manager v1.4.5
• HPS v11.3.11
• v8.4.3 or higher; HA dual stack support is available for version 8.4.4 or higher (excluding 8.5.1)

Known Limitations for IPv6:

• Work from Anywhere (WFA) is not supported.
• IPv6-native appliance and Endpoint Manager configurations are not yet supported.

The SecureConnector default IP address setting is IPv4, with IPv6 as the backup. Optionally, you can create or edit the Windows DisabledComponents registry key to set IPv6 as your preferred connection.

Registry Key details:

• Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\
• Name: DisabledComponents
• Type: REG_DWORD

This table shows a list of registry values and their IP preference behavior:

For more information, see: