Agent Control Panel Applet

Every Windows computer running the Athena agent gets an Athena Agent item in Windows Control Panel. It opens the Athena Agent Properties window. Anyone at the machine can use it to see which server the agent talks to, whether it is connected, when it last checked in and which policies it holds. It also runs a short list of local actions, such as Check in now or Collect inventory. It does the same job as the Configuration Manager applet that SCCM admins know. Every action taken in the window is recorded in Athena's audit log.

Opening the window#

• Open Control Panel → System and Security → Athena Agent. The item's tooltip reads "View the Athena agent's status, connection and local actions".
• Or open it directly from Run (Win+R), a command prompt or a shortcut you hand to users:

control /name Athena.AgentProperties

The window needs the Microsoft Edge WebView2 Runtime. Windows 10 and 11 usually include it. LTSC, Server Core and stripped-down images often do not. If the runtime is missing, a message box says so, gives the Microsoft download link, and offers to copy the agent status to the clipboard for your help desk. The copied status is the hostname, agent version, service state and each server's connection.

If the agent is updated while the window is open, the window reconnects by itself. It shows "Agent updated to <version>" and reloads every tab. If the window itself was updated, it shows "A newer version of this window is available" and a Reopen button.

Who can do what#

The agent service checks the Windows account of whoever is using the window on every request. The window cannot override that check. An account counts as an administrator only when it is a member of the local Administrators group and is running elevated. An administrator in a normal, non-elevated (UAC-filtered) session is treated as a standard user.

Administrator-only buttons show the Windows UAC shield. When a standard user clicks one, Windows asks for administrator credentials and runs only that one request elevated. The result appears in a message box. If the prompt is cancelled, nothing runs.

The tabs#

General#

Shows the hostname, agent version, operating system, Last inventory time and the state of the HermesAgent service. The Modules line lists each policy module. A module shows as configured once Athena has sent this agent a message for it since the service last started. Otherwise it reads "not configured". The agent has no record of your licence, so "not configured" can mean either that the module is not licensed or that it is not assigned to this machine.

Each server the agent is enrolled with gets its own block. A multi-homed agent shows several. Each block lists: Connection state and how long it has been connected, Agent ID, Last check-in, and the Client certificate subject, expiry and thumbprint. Times are in the computer's local time.

Components#

A read-only table of what is installed and active on this computer:

• Core agent: its version.
• Remote helper: its version, or "Not installed" (it is downloaded from Athena the next time the agent connects).
• Inventory: how often the agent reports status, and when inventory was last collected.
• Scan definitions: how many on-demand scan definitions the agent holds.
• Deployments: "Idle", or how many are running.
• One row per policy module ("Configured" / "Not configured"), plus Secure Boot and RustDesk with the time they were last collected.

Components are turned on from the Athena console, not from this window.

Actions#

Pick an action and click Run Now. Each row shows when that action last ran on this computer. See Local actions below for what each one does.

Policies#

Policies on this device is a read-only list of the latest policy this computer received for each policy module, such as Restart, Power, BitLocker and Shortcuts. For each policy it shows the server it came from, when it arrived, and the settings in plain language. For example: "Standby timeout: Plugged in: Never · On battery: 15 min". Settings are shown as they were received. They are not re-checked against the computer's current state.

• PINs, passwords, passphrases, secrets, tokens and keys are never shown. The agent removes them before it saves its local copy, so they are never written to disk either.
• If a module has no policy stored, it reads "No <module> policy received on this device". The agent cannot tell whether one is assigned in Athena. A policy only appears here after the computer receives it again following an agent upgrade that added this window.
• BIOS and Sysmon are not listed. BIOS remediation runs once rather than being held as a policy. To see what Athena has assigned to a device, use the console (see Policies).

Cache (debug files)#

Athena does not keep a package cache on endpoints. Each deployment runs in its own folder under C:\ProgramData\Hermes\Deployments and deletes it when the run finishes. A folder is left behind only if a step was set to skip cleanup, or if the run crashed or was stopped. This tab lists those leftover folders with their size, last-written time and state.

• In use: a running deployment owns the folder, or something was written to it in the last 10 minutes. In-use folders are never deleted.
• Leftover: Delete debug files removes it (administrator only). The button is greyed out unless there is at least one leftover folder, which is the normal state. Ownership is checked again at the moment of deletion. A folder whose files are still open is kept for next time.

Diagnostics#

Run test checks the path from this computer to each server the agent is enrolled with:

Each row shows Pass or Fail, a detail line and how long the check took. See Network Ports & Firewall for the ports involved. The tab also has:

• Open log folder: opens C:\ProgramData\Hermes\Logs in Explorer. The folder is readable by administrators only. See Agent Logs.
• Copy diagnostics: copies the version, each server's state, the components and the last test results as text, ready to paste into a ticket. Log lines are included only for an administrator.
• Recent log: the last 200 lines of today's agent log, for elevated administrators. A standard user gets Run as administrator to view the log instead. After the UAC prompt, that shows the last 40 lines in a message box.

Network#

For each server it shows the name, the Agent endpoint address and the Server CA subject and expiry. Addresses are managed by Athena and cannot be changed here. To move an endpoint to another server, use Agent Server Migration in the console.

Local actions#

Every action except the connectivity test needs the agent to be connected to at least one Athena server. Otherwise it is refused with "Not run: the agent is not connected to any Athena server.". When the agent is enrolled with more than one server, each action goes to every connected server.

Cooldowns#

Each action costs your server some work, such as an inventory upload, a scan or a certificate signing. So the agent limits how often actions can run on each computer. The limit applies to everyone using that computer, and administrators are limited too.

• Only one run per action happens at a time. Clicking again while it runs joins the current run ("Already running").
• The cooldown starts only when a run succeeds. A failed run does not use it up, so the user can retry once the problem is fixed.
• Too soon, the window shows "Rate-limited: try again in 3 min 20 s" and counts down.
• Last successful run times are saved on the computer, so restarting the agent service does not reset them.

Audit events#

Every action run from the window is sent to Athena and written to the audit log under its own event type, so you can filter on it on the Audit page or in your SIEM. Opening the window and reading tabs are not audited.

• The user on the event is the Windows account that used the window, for example CONTOSO\jdoe. The agent and hostname are the computer. The description reads like "CONTOSO\jdoe ran 'CheckIn' locally on agent 'PC-042' (elevated)". The details record whether the user was elevated, when the action happened on the computer, the result text, and the source ControlPanel.
• A successful action is logged at Information. A failed or refused one is logged at Warning, with the reason: AdminRequired, RateLimited, NoServerConnected, NotEnabled or Failed.
• A user who keeps clicking a refused button produces one refusal entry per action and reason for each cooldown period, not one per click.
• If the computer is offline, actions are queued on the computer and sent once it reconnects (it retries every minute).

All audit events are listed in the Audit Event Types Reference.

Removal#

The Control Panel item is removed whenever the agent is uninstalled: by the Windows installer, by hermescli uninstall (see Agent CLI and Tamper Protection), or by an uninstall started from Athena. An uninstalled agent does not leave behind an item that points to a missing program.

Troubleshooting#

Related#

• Agent CLI (HermesCLI): the command-line tool on every agent.
• Windows Agent: installing and running the agent on Windows.
• Agent Status: how the console decides a computer is online.
• Inventory: what Collect inventory collects.
• Policies: the policy modules shown on the Policies tab.
• Audit Event Types Reference: all audit events.