Availability and setup
Windows setup becomes available when a signed release has passed our Windows validation checks. The target systems are Windows 11 and Windows Server 2022/2025, including Server Core, on x64. Preview availability may differ from the Linux agent.
In Security Agents, create an installation, choose Windows, and select the capabilities it may use. For repository scans, choose a local directory. Run the generated command in PowerShell as an administrator. The installer includes its scanners and Python dependencies; you do not need Docker, WSL, or a separate Python installation.
The setup token expires after 30 minutes and can be exchanged only once. The agent then stores its runtime credential using Windows protection and restricted file permissions. Setup will not replace an existing enrollment.
What the agent checks
Host checks collect installed software, services, listening ports, processes, and selected Windows event metadata. Security checks inspect settings such as the firewall, Defender, disk protection, UAC, and remote desktop authentication. Unreadable or unavailable checks are reported as missing coverage.
Patch results use the computer’s configured Windows Update or WSUS source. A missing-update result reflects that source and the last successful query. Installed software inventory does not mean every Windows application has been checked against every CVE.
Code, web, and cloud assessments use the capabilities enabled for your installation. Cloud coverage follows the existing AWS and Google Cloud scope. Network shares are not supported as repository roots. Repository scans reject links and reparse points to help keep the scan within its selected directory.
Audit-only operation
The Windows agent does not kill processes, install updates, isolate hosts, or change security settings during assessments. Web probes use the existing target and request limits. AI investigations use the same tenant permissions and evidence controls as the Linux agent.
A restricted agent service runs scanners. A separate privileged collector reads protected host evidence through a local interface that accepts only fixed read operations. Neither service offers a general remote command prompt.
Troubleshooting
If setup reports that the release is unavailable, a Windows build has not been enabled for your environment. If a check cannot read a setting or event channel, review the reported coverage limitation before treating the assessment as complete. Server roles and installed Windows components can affect which checks apply.
Check the installation’s connection and capability status in the dashboard before assigning work. Use Windows Apps settings or the signed MSI for repair or removal. Local protected state is retained on removal; remove it only when you intend to discard the enrollment and buffered evidence.
Read the security agent guide