Use the Endpoint Agent Command-line tool with Nebula

Some Malwarebytes Nebula actions may be performed by command line to help with custom scripting or automation by software deployment and remote monitoring and management (RMM) tools.

The Endpoint Agent Command-line tool, EACmd, is a Windows™ application created to communicate with the Endpoint Agent service. This article covers suggested methods of using EACmd in your scripts or deployment methods.

EACmd works with the Endpoint Agent using the same communication method as the Endpoint Agent Tray program.

• You must open CMD as an administrator and change the directory to: C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\
• Once ready, use the following executable to leverage commands for the endpoint agent: EACmd.exe.
• If an uninstall password is enabled in the endpoint's policy, you will be prompted for the password for certain commands. Refer to the table below to see which commands require the Tamper Protection password. If you forgot the uninstall password, see Overview of Tamper protection settings in Nebula

Command Option	Purpose	Requires Tamper Protection?
-loglevel=VALUE	The level of logging to set the service. Valid values are Debug and Info.	No
-assetscan	Runs an asset scan on the endpoint.	No
-d, -diag	Collect a diagnostic log for the Endpoint Agent service.	No
-output=VALUE	Sets the output folder for diagnostic logs. The default folder is the Desktop.	No
-debug	Set the level of logging to debug for the program.	No
-refreshagentinfo	Update the agent information for the endpoint. This will immediately post the information to the cloud console.	No
-updateprotection	Manually retrieves freshest rules from the console and updates the protection service.	No
-updatesoftware	Manually checks for software and definitions update and if one exists, it is downloaded then installed (or paused) based on policy settings. For Patch Management customers, this command also updates supported third-party applications.	No
-versions	Displays version information for all Endpoint Agent components and plugins.	No
-runpendingsoftwareupdate	Manually checks for pending software updates and if one exists, it is installed regardless of policy settings.	No
-h, -help	Display a usage message for the EACmd program with all of the options.	No
-syncnow	Forces a sync with the Nebula cloud platform.	No
-testconnections	Tests connection to a list of Malwarebytes servers.  See detailed description below.	No
-certcheck=VALUE	Check if file passes signature check.	No
-getmachineids	Displays the current Account ID, Machine ID, and Nebula Machine ID of the endpoint.  Note: If values are null/empty, then the Malwarebytes Endpoint Agent is not registered with the console.	No
-resetmachineids	Generates a new Machine ID and Nebula Machine ID. Administrative privileges required.	Yes
-verifyaccounttoken=VALUE	Checks if the supplied account token matches the currently stored account token, returning 0 if matched. Note: This can be used in scripting to check if an endpoint is associated to the correct account.	No
-changeaccounttoken=VALUE	Changes the current account token and forces this single endpoint register as a new endpoint in the default Group in a different Nebula Console or OneView Site. See Move an endpoint between Nebula accounts or OneView sites for more detail. Administrative privileges required.	Yes
-proxy.server=VALUE	Changes the current proxy server address. Administrative privileges required.	Yes
-proxy.bypassOnLocal=VALUE	Enable or disable bypass proxy. Administrative privileges required.	Yes
-proxy.port=VALUE	Changes the current proxy port number. Administrative privileges required.	Yes
-proxy.user=VALUE	Changes the current proxy username. Administrative privileges required.	Yes
-proxy.password=VALUE	Changes the current proxy password. Administrative privileges required. Note: The proxy password is encrypted when stored at the endpoint.	Yes
-proxy.clear	Clear all proxy settings. Administrative privileges required.	Yes
-threatScan	Performs a Threat Scan unless Allow Users to run a threat scan is disabled in the policy.	No
-ContextScan=VALUE	Performs a scan on the directories listed in the target file. The value should be a simple text file that contains the full paths to directories or files to scan on separate lines.	No
-startmbamservice	Start the Malwarebytes Service. Administrative privileges required.	No
-stopmbamservice	Stop the Malwarebytes Service. Administrative privileges required.	Yes
-TamperProtectionEnabled	Check to see if a Tamper Protection password is enabled on the endpoint. Administrative privileges required.	No
-TamperProtectionPassword=VALUE	Use in conjunction with commands that require the tamper protection password. Indicate the tamper protection password, instead of being prompted for it.	No

Check for Protection Updates via command line (Windows)

This command performs an immediate check for Protection Updates. It is identical to performing a Protection Updates check from the Endpoints screen in the console.

Scans perform this check before scanning. The Protection Updates check also ensures Real-Time Protection uses the most recent updates.

Syntax

C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe -updateprotection

Check for Software Updates via command-line (Windows)

This command performs an immediate check for updates to the Malwarebytes software on the endpoint. It is identical to performing a Software Updates check from the Endpoints screen in the console.

Any manual check for Software Updates ignores the Pause Software Updates policy setting.

Syntax

C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe -updatesoftware

Get Nebula Machine ID via command-line (Windows)

This command displays the current Account ID, Machine ID, and Nebula Machine ID. 

Syntax

C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe -getmachineids

Reset Nebula Machine ID via command-line (Windows)

This command generates a new Machine ID and Nebula Machine ID.

Use the command if the Malwarebytes Endpoint Agent software was deployed improperly using a cloned Windows OS image.

To verify these changes, run the Get Nebula Machine ID command before and after running the Reset Nebula Machine ID command.

Note: If the endpoint is a virtual machine, verify the VM hardware profile has a unique UUID and is not a duplicate or clone.

Syntax

C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe -resetmachineids

Test connections

This command instructs the Malwarebytes Endpoint Agent to test connections to a list of URLs.

For each URL tested, if ExpectedStatusCode matches the received StatusCode, the Result will be true (success). Otherwise false (failure) will be returned. 

If any Result is false, the message Command complete: Network Test Failure (1232) - an error occurred during network testing displays. 

Syntax

C:\Program Files\Malwarebytes Endpoint Agent\UserAgent\EACmd.exe -testconnections

Note:

• There may be individual, transient failures. 
• If there are multiple or consistent failures, check Network access requirements and firewall settings for Nebula. 

 

Return to the Malwarebytes Nebula Administrator Guide.