--- title: "Agent Security Options in Agent Settings" slug: "agent-security-options-in-agent-settings" updated: 2025-07-03T08:54:42Z published: 2025-07-03T08:54:42Z canonical: "support.controlup.com/agent-security-options-in-agent-settings" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.controlup.com/llms.txt > Use this file to discover all available pages before exploring further. # Agent Security Options in Agent Settings ControlUp continuously improves the security protecting the communication between the ControlUp Real-Time Console, Agents, and Monitors in your environment. For more information on how to set up secure agents, see [ControlUp Agent Security Best Practices](/tim-reorg/docs/agent-security-best-practices). You can use the following enhancements for the ControlUp Agent when you add machines to the ControlUp Console: - [Encrypt communication](/docs/agent-security-options-in-agent-settings#encrypt-agent-communication) between the agent, console, and monitors. - Default [Authentication Key](/docs/agent-security-options-in-agent-settings#agent-authentication-key) for all deployed agents. - [Registration Key](/v1/docs/agent-security-options-in-agent-settings#agent-registration-key) required for all [outbound agents](/v1/docs/agent-outbound-communication). ## Encrypt Agent Communication You can select the option to use only encrypted communication between all agents within your ControlUp organization. By default, this option isn't selected. ### **Prerequisites**: - You must be a user with the **Organization Owner** role or have **Roles Manager** permissions set in the [**Security Policy**](/v1/docs/security-policy-pane) panel to select this option. - .NET Framework 4.5 or higher must be installed on the console. - .NET Framework 4.8 or higher must be installed on the agent and monitor. #### **To Encrypt Communication with ControlUp Agents:** 1. In **Real-Time Console > Settings > Agent Deployment Settings**, select **Use only encrypted communication**. 2. Restart the Real-Time Console and all monitor clusters. 3. Update all agents to latest version. ![Agent Deployment Settings window with Use only encrypted communication selected.](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AgentEncrypt.png) ### Troubleshooting If this option is selected and you receive any of the following error messages: - The agent does not support encrypted communication. Upgrade the agent to latest version. - Failed to establish an encrypted connection with the agent. - Operation timeout. Ensure that **all consoles** are running the following: - .NET framework version 4.5 or higher. Ensure that **all** **agents** are running the following: - .NET Framework 4.8 or higher. Ensure that **all monitors** are running the following: - .NET framework version 4.8 or higher. ## Agent Authentication Key ControlUp generates a unique authentication for every ControlUp organization. By default, all agents are configured with this **public** Authentication Key, and accept communication only from trusted consoles or monitors that have the same corresponding **private** Authentication Key. The Authentication Key is automatically configured for the agent machine during deployment. ### Access Key Value By default, the Agent Authentication Key is the method of authenticating communication between the agents, consoles, and monitors, so you don't need to perform any action. ![Agent Deployment settings window with the agents authentication key Copy button selected](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/CopyAuthKey.png) To access the Authentication Key: 1. In the Real-Time Console, click **Settings > Agent**. 2. Under **Agent Authentication Key**, click **Copy** to copy the key value to your clipboard. The same key is used for all agents deployed from this console. On the agent machine, this Authentication Key is stored in the following registry key: `HKLM\SOFTWARE\Smart-X\ControlUp\Agent\Communication\AuthKey` You can manually set the key at any time and you aren't required to restart the agent machine. You can also access the Authentication Key if you run the **Get-AgentPublicKey** PowerShell cmdlet on your monitor machine. ### Add Key to Configuration Files that Install the Agents When you install agents using the **Add Machine** feature in the Real-Time DX Console, by default, this key is automatically added to the agent machine. If you **don't** choose to deploy the agents automatically when you add machines to your organization, you must manually add the same key as displayed in the **Agent Deployment Settings** page to the configuration file that you use to add the agent. **To manually configure the key**, use the following registry setting on all machines with the agent deployed: - Registry Key: `HKLM\SOFTWARE\Smart-X\ControlUp\Agent\Communication` - Value Name: `AuthKey` - Value Type: `REG_SZ` - Value Data: `Public key string base64 encoded `(from **Agent Deployment Settings**) If you **do** choose to deploy the agents automatically when you add machines to your organization, you can use the Agent MSI installer to configure the Agents Authentication Key using an MSI parameter. If you use the link to **Download MSI Installer** from **Agent Deployment Settings**, the MSI is already configured with the parameter, but you must update the key value. **To deploy agents with the key using an MSI installer command parameter**, update the following key values: - Parameter Name: `AUTHKEY` - Parameter Value: `AUTHKEY=agent authentication key` - Usage Example: `msiexec /i Agentinstaller.msi AUTHKEY=` If you install an agent with this parameter, it configures the specified authentication key for the agent. ## Agent Registration Key A new Registration Key is required to use [agent outbound communication](/v1/docs/agent-outbound-communication) instead of agent inbound communication. The Registration Key enables agents to obtain a Personal Access Token (PAT) from the ControlUp security service. If you don't want to use the outbound communication feature, ignore this key. ![Agent Deployment settings window with the agent Registration key Copy button selected](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/CopyRegKey.png) For more details about the Registration Key, see [Manual Installation](/v1/docs/connect-to-your-machines#manual-installation-with-gui).