diff --git a/docs/docs/meshcentral/config.md b/docs/docs/meshcentral/config.md
index 5705ac10..5e790616 100644
--- a/docs/docs/meshcentral/config.md
+++ b/docs/docs/meshcentral/config.md
@@ -385,6 +385,11 @@ See description for information about each item.
           ],
           "description": "The HTTP proxy to use when contacting the time stamping server, if false, no proxy is used. By default, the npmproxy value is used."
         },
+        "lockAgentDownload": {
+          "type": "boolean",
+          "default": false,
+          "description": "When enabled, MeshCentral will block all downloads of MeshAgent including install scripts, if the user is not logged in"
+        },
         "ignoreAgentHashCheck": {
           "type": [
             "boolean",
@@ -1700,6 +1705,11 @@ See description for information about each item.
               }
             }
           },
+          "lockAgentDownload": {
+            "type": "boolean",
+            "default": false,
+            "description": "When enabled, MeshCentral will block all downloads of MeshAgent including install scripts, if the user is not logged in"
+          },
           "geoLocation": {
             "type": "boolean",
             "default": false,
diff --git a/meshcentral-config-schema.json b/meshcentral-config-schema.json
index 6e19412e..0b22f9cd 100644
--- a/meshcentral-config-schema.json
+++ b/meshcentral-config-schema.json
@@ -378,6 +378,11 @@
           ],
           "description": "The HTTP proxy to use when contacting the time stamping server, if false, no proxy is used. By default, the npmproxy value is used."
         },
+        "lockAgentDownload": {
+          "type": "boolean",
+          "default": false,
+          "description": "When enabled, MeshCentral will block all downloads of MeshAgent including install scripts, if the user is not logged in"
+        },
         "ignoreAgentHashCheck": {
           "type": [
             "boolean",
@@ -1693,6 +1698,11 @@
               }
             }
           },
+          "lockAgentDownload": {
+            "type": "boolean",
+            "default": false,
+            "description": "When enabled, MeshCentral will block all downloads of MeshAgent including install scripts, if the user is not logged in"
+          },
           "geoLocation": {
             "type": "boolean",
             "default": false,
diff --git a/sample-config-advanced.json b/sample-config-advanced.json
index 074c6fbc..0cd4dcf6 100644
--- a/sample-config-advanced.json
+++ b/sample-config-advanced.json
@@ -101,6 +101,7 @@
     "_mpsTlsOffload": true,
     "_mpsHighSecurity": true,
     "_no2FactorAuth": true,
+    "_lockAgentDownload": true, 
     "_runOnServerStarted": "c:\\tmp\\mcstart.bat",
     "_runOnServerUpdated": "c:\\tmp\\mcupdate.bat",
     "_runOnServerError": "c:\\tmp\\mcerror.bat",
@@ -312,6 +313,7 @@
       "_twoFactorCookieDurationDays": 30,
       "_agentInviteCodes": true,
       "_agentNoProxy": true,
+      "_lockAgentDownload": true, 
       "_geoLocation": true,
       "_novnc": false,
       "_mstsc": true,