Deploy on Windows

The InfraScout agent runs as a Windows Service and gives InfraScout visibility into the host through shell, PowerShell, WMI, and Event Log capabilities. This guide walks you through downloading the binary, enrolling the agent with your InfraScout server, and installing it as a persistent service.

Prerequisites

The agent requires Windows 10 or Windows Server 2016 or later. PowerShell 5.1 is sufficient and ships with all supported Windows versions. The host needs outbound access to two endpoints on your InfraScout server: the enrollment service over HTTPS during setup, and the gRPC server (default port 50051) for its ongoing connection. You need a local administrator account on the host to install the service, plus either an InfraScout Admin account to sign in with — the one-command path below — or an enrollment token generated in the dashboard.

Download the Agent

Open the InfraScout dashboard and navigate to Settings → Downloads. Download agent-windows-amd64.exe for x64 hardware, or agent-windows-arm64.exe if you are running ARM-based hardware such as Windows Dev Kit devices.

Move the binary into a permanent directory and rename it to infrascout-agent.exe before proceeding. C:\Program Files\InfraScout\ is a sensible choice that keeps it off the system path and under a consistent location, and it is the path every command in this guide uses.

Enroll in One Command

Enrollment does not need a token. enroll auto signs you in to Microsoft Entra ID with a device code, provisions the agent, enrolls it, and installs and starts the Windows service. Run it from an elevated PowerShell prompt:

& "C:\Program Files\InfraScout\infrascout-agent.exe" enroll auto --api https://api.infrascout.cloud

The command prints a short code and a URL. Open the URL, enter the code, and sign in with an account holding the InfraScout Admin role — the role is checked server-side, so a non-admin sign-in is refused rather than half-provisioning a host. The agent resolves the enrollment and gRPC addresses from the server itself, which is why --api is the only value you supply.

The Agents page in the portal generates this command with your own API address already filled in, next to the matching download command for the architecture you pick.

The access token and the enrollment material live only in memory — neither is written to disk or logged. Re-running against an already-enrolled host replaces the service registration cleanly rather than leaving one running under an old identity.

Put the binary somewhere only administrators can write

Whichever path you use, move the binary to a location whose ACL grants write access only to Administrators and SYSTEM — C:\Program Files\ inherits exactly that — before enrolling. Service installation registers the binary at its current path and then runs it as NT AUTHORITY\SYSTEM — enroll from a user profile or a downloads folder and you leave a privileged service executing a file any local user could replace.

Enroll With a Token

Where device-code sign-in is not an option — an unattended image build, or a deployment where nobody holds the Admin role at install time — enroll with a token instead. Open an elevated PowerShell prompt and run the enrollment command. The token page in the dashboard shows every value you need to fill in — the token itself, your tenant and agent IDs, the enrollment service URL, and the gRPC server address:

& "C:\Program Files\InfraScout\infrascout-agent.exe" enroll `
    --token YOUR_ENROLLMENT_TOKEN `
    --tenant-id YOUR_TENANT_ID `
    --agent-id YOUR_AGENT_ID `
    --server https://YOUR_ENROLLMENT_URL `
    --grpc-addr YOUR_GRPC_HOST:50051 `
    --output-dir "C:\ProgramData\InfraScout"

The --server value is the HTTPS enrollment service URL used only during setup, while --grpc-addr is the address the agent connects to afterward for its ongoing session. The agent generates a key pair, completes a mutual TLS certificate exchange, and writes its certificate, key, CA chain, and agent-config.yaml to the directory given by --output-dir. Using C:\ProgramData\InfraScout keeps these files in a stable, system-wide location that the service can rely on. A confirmation message displays the agent's assigned ID, which you can also see in the dashboard immediately after enrollment.

INFO

The enrollment token is consumed on first use. If enrollment fails partway through, generate a new token before retrying.

Install as a Windows Service

If you enrolled with the one-command path, the service is already installed and running — skip to the next section. After a token enrollment, install the agent as a Windows service so it starts automatically and survives reboots. Pass the absolute path to the config file you just generated — the service bakes this path into its registration, so it must be absolute. Run in an elevated PowerShell prompt:

& "C:\Program Files\InfraScout\infrascout-agent.exe" service install --config "C:\ProgramData\InfraScout\agent-config.yaml"

Then start the service:

Start-Service InfraScoutAgent

Confirm it is running:

Get-Service InfraScoutAgent

The service runs under the NT AUTHORITY\SYSTEM account. If you ever need to stop or remove it, run Stop-Service InfraScoutAgent followed by infrascout-agent.exe service uninstall from an elevated prompt.

Configure LDAP (Optional)

If you want the agent to run LDAP queries against Active Directory — for example, to enumerate groups, users, or organizational units during an assessment — add an ldap block to agent-config.yaml. The file lives in the output directory you chose during enrollment (C:\ProgramData\InfraScout\agent-config.yaml):

ldap:
  server: ldap://dc01.example.com
  base_dn: DC=example,DC=com
  bind_dn: CN=svc-infrascout,OU=Service Accounts,DC=example,DC=com
  bind_password: YourServiceAccountPassword

After saving, restart the service so the agent picks up the new configuration:

Restart-Service InfraScoutAgent

On first startup after this change, the agent encrypts bind_password in place — the file will show an encrypted value rather than the plaintext you entered.

TIP

Use a read-only service account with minimal Active Directory permissions. The agent only reads from Active Directory and never writes to it.

Capabilities on Windows

After a successful enrollment, the agent advertises the following capabilities to InfraScout:

• shell — run commands via Windows Command Prompt
• powershell — run PowerShell scripts and cmdlets
• wmi — execute WMI queries
• eventlog — read Windows Event Logs natively, with no PowerShell or Get-WinEvent involved. It exposes two operations: enumerate channels using wildcard filters and return per-channel metadata such as record count, enabled state, and last write time; and run a structured event query with server-side filtering by event ID, level, provider, time window, and event-data fields
• ldap — search Active Directory via LDAP (requires LDAP configuration; see Configure LDAP above)

InfraScout can use all available capabilities during an assessment session to collect data, run checks, and surface findings.

Troubleshooting

Service fails to start — Open Event Viewer and check the Application log for entries from InfraScoutAgent. The most common cause is a missing or corrupt agent-config.yaml. If the file is absent or damaged, re-run the enrollment command to regenerate it, then try starting the service again.

Enrollment fails with a certificate error — Verify that the host can reach the InfraScout server on port 443. If your network routes outbound traffic through a proxy that performs SSL inspection, the mTLS client certificate exchange will fail. mTLS is incompatible with SSL inspection proxies — you need to exclude the InfraScout server address from inspection or route it directly.

Agent appears offline in the dashboard — Confirm the service is running with Get-Service InfraScoutAgent. Also check that the system clock is accurate; certificate validation fails when the host clock is more than a few minutes out of sync with the server. Windows Time service (w32tm /resync) can correct clock drift.