Our organization makes heavy use of ephemeral AVD hosts that are reimaged daily. Prior to our implementation of Tamper Protection, we were able to run install and uninstall Huntress scripts prior to provisioning and deprovisioning hosts. This would allow us to keep our agent counts reasonable by offboarding hosts before they are destroyed. After implementing Tamper Protection, the uninstall script no longer removes the dead hosts from the Huntress portal. I understand there is a feature for exclusion based on client or hostname. However, the ephemeral AVD hosts have dynamically generated host names, so we are unable to set an exclusion rule for any future hosts provisioned. I believe an effective solution would be to allow for client-based Tamper Protection exclusions that can be set based on device tag. This way, when we run the install script on our AVD hosts, we can tag them as ephemeral and exclude them from Tamper Protection to allow the uninstall. I realize that disabling Tamper Protection on any host is potentially risky. However, in an ephemeral host situation where we are piping event logs into Log Analytics and a Storage Account, we believe we have effectively addressed the risk of potentially losing visibility. Would appreciate feedback on this suggestion as soon as possible, as we would not like to leave our hosts undefended, but do not want to accumulate additional charges for stale hosts.
