Shared company key

Give every computer its own key and retire the organization-wide shared company key, so one compromised computer cannot speak for all the others.

Open Agent keys in your console

Where to find it
Devices › Agent keys
Who can use it
Super Admins of the organization, or of the organization that manages it
For
Administrators of organizations that use the Lavawall agent
Plan
Every plan that includes the Lavawall agent. See pricing

What the shared company key is

Screenshots of this page are coming soon. The steps below use the labels you see in the console.

Every organization in Lavawall® has a shared company key. Earlier Lavawall agents kept a copy of it on every computer in the organization. They used it to prove to Lavawall that they belong to that organization, and it protected sensitive details the computers report, such as BitLocker recovery keys and Windows product keys.

A key that every computer holds is only as safe as the least protected computer. Someone who gains administrator control of one computer could copy the key and then pretend to be any computer in the organization: send false inventory or health results, or hide a problem.

Lavawall agents now create their own key on each computer, kept in the computer’s security chip where it has one. Each computer then speaks only for itself. When every computer in an organization is ready, you can retire the shared company key so that it no longer exists on any computer and Lavawall no longer accepts it.

Why retire it

  • One computer can no longer speak for the rest. A key taken from one computer is useless on any other.
  • Smaller blast radius. A lost, stolen or compromised computer affects only itself; you deal with that one computer.
  • Recovery keys stay protected separately. Together with BitLocker recovery key escrow, the computers no longer carry anything that could open other computers’ recovery keys.
  • Evidence for audits. Each computer’s key, and every change to it, is recorded in the activity log, which helps with SOC 2, ISO 27001, CJIS and cyber insurance questions about device identity.

What you see on the Agent keys page

  1. Organization: choose your own organization or one of the clients you manage.
  2. Shared company key: whether the key is In use or Retired, and a readiness summary: how many computers seen in the last 30 days are ready, how many are not, and how many have not been seen for longer and do not count.
  3. Retire company key and Undo retirement.
  4. Signed requests with timestamps (protocol v2): Require protocol v2 makes every request from a computer carry the time it was made and a one-time value, so a recorded request cannot be replayed.
  5. Enrolment token and BitLocker recovery key escrow: see Enrolment token and BitLocker recovery key escrow.
  6. Computers: a sortable, filterable table with each computer’s Last check-in, whether the User agent, LAN scanner and Elevation agent have their own key (own key, needs the company key or not installed), the Remote agent version, and whether the computer is Ready.

How to retire the shared company key

Work through one organization at a time, starting with a test organization. The order below avoids interruptions.

  1. In the console, go to Devices › Agent keys and choose the Organization.
  2. Under BitLocker recovery key escrow, click Create escrow key, then Re-escrow now until no drives are left in the old format.
  3. Create an enrolment token, update your saved install commands and deployment scripts, then require the token.
  4. Watch the Computers table until every recent computer shows own key for each installed agent and a current Remote agent version. Update or remove computers that stay not ready.
  5. Click Require protocol v2.
  6. Click Retire company key and confirm. The button is available only when every computer seen in the last 30 days is ready.

What changes when you retire it

  • Lavawall stops accepting the shared company key for that organization straight away.
  • Each computer deletes its copy the next time it connects, once every Lavawall agent on it has its own key. Until then it keeps the copy but can no longer use it with Lavawall.
  • Computers that have not been seen for more than 30 days do not block retirement. When one comes back, reinstall the agent on it.
  • Nothing changes for the people using the computers, and remote support, patching and monitoring carry on as before.

How to undo it

Click Undo retirement on the same page. Lavawall accepts the shared key again for that organization. Computers that already deleted their copy keep working with their own keys. Undo is available until Lavawall support replaces the organization’s old key, which is the final step that makes any copy left in old backups useless.

Who can see and change it

  • Only a Super Admin of the organization, or of the organization that manages it, can open the page and use these controls. Other roles see a message that only a Super Admin can manage agent keys.
  • Lavawall checks the role and the organization again on every action, not just when the page opens.
  • High-impact changes (retiring, undoing, requiring protocol v2) ask you to confirm before they take effect.

What is recorded in the activity log

  • Retiring the shared company key and undoing it, with who did it, when and for which organization.
  • Turning protocol v2 on or off.
  • Each computer’s own key being enrolled, replaced or revoked, and any request refused because the key did not match the computer.

Frequently asked questions

What does the shared company key do?
It is an organization-wide key that earlier Lavawall agents kept on every computer to prove they belong to the organization and to protect sensitive details they report, such as BitLocker recovery keys. Each agent now has its own key on each computer, so the shared key can be retired.
What is the risk of keeping the shared company key?
Every computer holds a copy, so someone with administrator control of any one computer could copy it and pretend to be any computer in the organization. Retiring it limits the damage from one compromised computer to that computer.
Why is Retire company key greyed out?
At least one computer seen in the last 30 days is not ready yet: one of its agents still needs the company key, or its remote agent needs an update. The Computers table shows which ones.
Will retiring it interrupt my users?
No. Ready computers already use their own keys. Only a computer that has been offline for more than 30 days needs its agent reinstalled when it returns.
Can I undo a retirement?
Yes. Click Undo retirement on the Agent keys page. It stays available until Lavawall support replaces the organization’s old key.
Do I need to do this for every client?
Retirement is set per organization. An MSP Super Admin can do it for each client organization it manages from the same page, one organization at a time.

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.