1. Code42 Support
  2. Incydr
  3. Incydr administration
  4. Monitoring and managing

Deactivate and reactivate users and agents

Updated

Overview

To pause and resume Incydr monitoring, or provide and revoke access to users' data in your Incydr environment, you may need to deactivate and reactivate users and agents. This article explains how to:

Definitions

The terms below are used in this article.

agent

An installed instance of Incydr software. A single device may have a combination of the insider risk, backup, and legacy agents installed.

cold storage

Temporary holding state for archives after they are deactivated but before they expire and are permanently deleted. This is similar to a file in your computer’s Recycle Bin or Trash. A user who has an archive in cold storage still consumes a user license. Administrators can retrieve archives from cold storage throughout the cold storage retention period.

deactivate

Stop a backup and move the archive into cold storage (for eventual deletion). Incydr monitoring stops. Licenses are not immediately freed by deactivation. Agents, users, and organizations can be deactivated. Deactivated users cannot sign in and cannot be added to a legal hold.

device

The physical endpoint upon which an agent is installed.

Before you begin

Review the Incydr structures for user management and archive storage:

Deactivate and reactivate users

Deactivate a user

  1. Sign in to the Incydr console.
  2. Select Administration > Environment > Users.
  3. Click a row in the Users list to open that user's details.
    Update the user's email address
    An email address can be used with only one Incydr user account at a time. If you want to use this email address again (as the email address for a new user in another organization, for example), change the email address for the user you are deactivating before adding it to a new user in another organization.

    For example, edit the user details in the existing account to change the email address (for example, adding "_deactivated" before the @ symbol) and then deactivate that existing account).
  4. From the Actions menu, select Deactivate.
  5. When the confirmation message appears, click Deactivate.

When you deactivate a user: 

  • The user and all agents associated with this user account are deactivated immediately. Incydr monitoring stops, unless this deactivated user is added to a watchlist.
  • All backup archives owned by this user are placed into cold storage.
Deactivation of users on legal hold

Backup agent and legacy agent only

If users who are custodians under a legal hold are subsequently selected for deactivation (for example, from the Incydr console, a provisioning provider, or API), they are not deactivated immediately because their data must be retained for legal hold purposes. Instead, they are blocked. Once these blocked users are released from legal hold, they are deactivated automatically. 

Activate a deactivated user

  1. Sign in to the Incydr console.
  2. Select Administration > Environment > Users.
  3. Filter the list to view deactivated users.
    1. Click Filter Filter icon.
    2. Under Status, select Deactivated.
    3. Click Apply.
      The Users list updates to show deactivated users.
  4. Click a row in the Users list to open that deactivated user's details.
  5. From the Actions menu, select Activate.
  6. When the confirmation message appears, click Activate.
    The user is activated and Incydr monitoring resumes. You must activate any agents associated with this user separately.

Deactivate and reactivate agents

Deactivate an agent

  1. Sign in to the Incydr console.
  2. Select Administration > Environment > Agents.
  3. Select the checkbox next to one or more active agents.
  4. Click the Deactivate button that appears at the top of the list to deactivate the selected agents.
  5. When the confirmation message appears, click Deactivate.
    The selected agents are deactivated immediately. Incydr monitoring stops. Any associated backup archives are placed into cold storage.

For backup agents configured to auto-register users, block the agent before deactivating it. (From the agent details, select Actions > Block.) Without first blocking the agent, it may reactivate automatically.

Activate a deactivated agent

Insider risk agents can only be re-activated within 30 days of deactivation. After 30 days, you must uninstall and redeploy the insider risk agent to resume Incydr monitoring.

  1. Sign in to the Incydr console.
  2. Select Administration > Environment > Agents.
  3. If needed, filter the list to view deactivated agents.
    1. Click Filter Filter icon.
    2. Under Status, select Deactivated.
    3. Click Apply.
      The Agents list updates to show deactivated agents.
  4. Select the checkbox next to one or more deactivated agents.
  5. Click the Activate button that appears at the top of the list to activate the selected agents.

When an agent is reactivated: 

  • The agent is activated and Incydr monitoring resumes within 24 hours.
  • Its unexpired backup archives are moved out of cold storage. When the user signs in to the backup agent, backups resume automatically.
  • (Optional) To restore files from the reactivated agent, restore the files from the Incydr console. 
  • If the user signs in from a different device, the user must replace the device from the backup agent or from the Incydr console in order to resume backing up to the archives moved out of cold storage.