Turn execution off

1Choose the switch that matches what you want to stop

Rapport has two switches, and they stop different things. To stop command execution on a set of devices, use Remote commands. Use Shell tool on its own if technicians should keep running approved tasks and you only want the assistant to stop running shell commands.

2Turn off the assistant’s shell for the organization

Open Admin → AI Assistant. Under Capabilities & limits, switch Shell tool off. The change saves as you make it. A conversation already running keeps the earlier setting until it next pauses and resumes, so use Stop in that conversation if it must end now.

Enlarge

What you should see: New conversations are offered no shell tool. A command approved earlier does not run if the setting is off when its conversation resumes.

3Turn off remote commands by policy

Open Admin → Agent policies and select the policy. Switch Remote commands off, choose Save, and complete MFA if prompted. Do this for every policy that covers the devices. An OU policy wins over a tag policy, and a tag policy wins over the All agents (tenant default) policy, so changing the default alone leaves devices covered by an enabled OU or tag policy unchanged.

Enlarge

• New commands for covered devices are refused.
• Queued commands stop being delivered as soon as the policy is saved. They stay queued and may be delivered if you switch back on, so cancel any you no longer want first.
• Running commands are stopped when the device next fetches its policy, which depends on the policy’s Config poll interval (seconds).
• Rules that run scripts are refused on those devices, and script-based checks stop.

4Know what still runs on the device

Turning execution off does not stop the agent, so “nothing runs on the device” would not be accurate. These keep running. In the policy, each reporting module and the device assistant has its own switch. Built-in checks and AI processing have none.

• Reporting: heartbeat, inventory, telemetry, experience events and issue detection, plus operation timing or workforce activity if you enabled them.
• Built-in checks: detections that use Rapport’s read-only checks keep running.
• Investigation: the device assistant can still run its built-in read-only checks and read files. Log, crash-report and system-configuration folders are read immediately. Any other path waits for a technician. Credential stores, browser profiles, mail and messages are refused, even if approved.
• AI processing: conversation text and those results still go through Rapport to the AI provider.

5Decide separately about the signed updater

Neither switch touches Signed agent updater, which is its own part of the policy. It installs only signed Rapport agent releases that your organization’s update settings allow. It does not run your commands or scripts, so devices can keep updating while execution is off. Only the manual Update agent command stops with Remote commands.

Enlarge

• To hold every device on its current version, choose Hold current versions in Admin → Agent releases.
• To stop one policy’s rollout, use Emergency halt in that policy. Installed versions stay in place.
• To stop update checks on those devices, switch Signed agent updater off.

6Confirm it took effect

Check the saved policy version and time, then wait for the device to fetch its policy. Try a harmless command on a covered device, such as Pull inventory: it should be refused. Ask the assistant on that device to run a shell command: it should say the shell is unavailable. Both changes are recorded in Audit log.

What you should see: Commands to covered devices are refused, the assistant uses only its built-in checks and file reads, and the device keeps reporting.