Install & approve the Windows agent

Windows servers and workstations are managed by the Skans agent — a lightweight service that runs on the endpoint and handles patching, inventory, Defender health, compliance checks, logs, and metrics, reporting back over mutual TLS. This is the agent lane; cameras and IoT go the agentless route instead.

1. Deploy the agent #

From a Windows device’s detail page (or the wizard’s Find & secure devices step), choose Deploy agent. Skans publishes the agent through GPO / SYSVOL to its managed-computers OU. The target picks it up and installs it on its next Group Policy refresh or reboot.

TEXTCopy
Deploy agent  →  published to GPO (Skans computers OU)
              →  installs at next gpupdate / reboot

There’s no installer to carry from machine to machine — the appliance pushes it. (An opt-in immediate push exists for when you don’t want to wait for the next policy cycle; the GPO path is the default.)

2. Licence acceptance happens at install, and is recorded #

The agent package has no licence dialog and can’t have one — it installs as SYSTEM in session 0, where a dialog is an invisible hang. So acceptance is asserted on the install command (ACCEPTEULA=1) and written to the endpoint, rather than clicked on the endpoint.

The deployment Skans generates for you already states it. The acceptance it asserts is the one you gave in the console when you chose to deploy the agent to this site — not the technician at the machine, who isn’t present. If you build your own deployment by hand, you must state it too, or the install is refused rather than proceeding with no agreement in force.

Each endpoint keeps its own record under HKLM\SOFTWARE\SkansLabs\Agent:

That record is also load-bearing, not just a paper trail: an upgrade reads it and proceeds on the acceptance already given. Delete it and the next silent upgrade is refused.

3. The two manual gates #

Two steps genuinely can’t be done purely from the console — the wizard walks you through them:

• Domain-join the Windows box (needs a reboot and credentials on the machine).
• Machine-certificate bootstrap — on its first domain policy cycle the box auto-enrolls its own machine certificate from the built-in CA. That certificate is the trust anchor the agent’s mutual-TLS connection uses.

4. Code-signing is required #

The agent binary is Authenticode code-signed before rollout using a dedicated code-signing identity from the built-in CA. This isn’t optional polish: the appliance’s own Defender ASR ransomware rule blocks unsigned interactive Skans binaries, so an unsigned agent won’t run. Signed agents install cleanly with zero Defender detections — the signature travels with the bytes into SYSVOL, and the publisher refuses to ship a package it can’t verify as signed.

5. Approve it #

An agent that has installed and checked in appears in the console immediately as pending — you don’t wait for a discovery cycle. Approve it on the device’s detail page.

By design, a pending agent receives no commands until you approve it. On approval, Skans automatically:

1. Correlates the agent to the right device record (by directory GUID, then IP, then hostname), so you get one correctly-typed row instead of duplicates,
2. seeds the telemetry planes — inventory, metrics, and Defender health are enabled by default (you can opt out), and
3. unifies the record to the machine’s directory object.

How the agent talks to the appliance #

sequenceDiagram
  autonumber
  actor Op as Operator
  participant A as Windows Agent
  participant H as Agent Hub :7326
  participant C as Trusted Core
  A->>H: enroll (client cert, mutual TLS)
  H->>C: relay over local pipe
  C-->>A: pending — awaiting approval
  Op->>C: approve the device
  loop every ~45s
    A->>H: check in
    H->>C: relay (hub holds no key)
    C-->>A: signed command set
    Note over A: verify signature, then execute
    A->>H: report results + telemetry
    H->>C: relay to monitoring store
  end

The agent only ever dials out to the hub on 7326; it has no inbound listener. The hub is a low-privilege relay that holds no signing key — every command the agent runs is signed by the trusted core.

What an approved agent does #

Once approved, the agent delivers the full Windows management set:

• Patching — schedules Windows updates and reports per-host pass/fail
• Inventory — hardware, software, and configuration
• Defender health and compliance checks measured on the box itself
• Logs & metrics — shipped to the appliance
• Backup — configuration/app data off the source machine

Verify #

On the device’s detail page you should see the agent online, a valid machine certificate, inventory populated, and a per-device compliance readout. Anything the agent hasn’t actually measured yet reads as not verified rather than being assumed green — only an on-box reading counts.