Windows systems

Requirements

• Windows 10, Windows 11 or Windows Server, x86-64.
• PowerShell run as Administrator, once, for the installation.
• The system can reach https://<appliance>:8080.

Install

1. In the console, open Systems → Add system and choose Windows.
2. Copy the command. It is a single PowerShell line with a short-lived install token.
3. Open PowerShell as Administrator on the system, paste the command and press Enter.

The installer puts the agent in %ProgramData%\VCLocal\garrison-agent.exe and registers a scheduled task, GarrisonAgent, that runs it as SYSTEM at start-up and restarts it if it stops. The system appears in Systems within a few seconds.

Known limitation

On Windows the installer download is not yet pinned to the appliance’s key the way the Linux command is, and the permissions of %ProgramData%\VCLocal are not yet locked down to Administrators. Install from a network you trust until this is fixed.

After enrolment

Tag the system and assign roles as for Linux systems. The Log collector role installs Grafana Alloy and sends Windows event logs and metrics to Observe. The Threat-hunting console role adds Sysmon.

Remove

Delete the system in the console, then see Uninstall.