Skip to content

Windows Agent

The SentriKat Windows Agent is a PowerShell script (sentrikat-agent-windows.ps1) that collects installed software inventory and reports it to your SentriKat instance. It runs as a Windows Scheduled Task (default: every 4 hours) — no service, no MSI, nothing resident.

Requirements

  • Windows 10/11 or Windows Server 2016+
  • PowerShell 5.1 or later
  • Network access to your SentriKat server (HTTPS recommended)
  • Administrator rights for the install step

Installation

There are two official ways — both give every machine its own key.

  1. In SentriKat go to Integrations → Agent Deploy → Deploy on a machine
  2. Click Windows — this downloads sentrikat-agent-windows.ps1 with a unique per-host key already baked in (nothing to paste)
  3. On the target machine, from an elevated PowerShell in the download folder:
powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Install
  1. In SentriKat go to Integrations → Agent Deploy → Mass / automated deploy and click Create Install Token
  2. Copy the ready-made install command (shown once). It looks like:
powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Install `
  -ServerUrl "https://sentrikat.company.com" -EnrollToken "<token>"
  1. Push the script + that command with your tooling (Intune, GPO, PDQ, Ansible). Each machine exchanges the token once for its own per-host key on first run; the token is revocable at any time.

Why -ExecutionPolicy Bypass?

Browsers mark downloaded files (Mark-of-the-Web) and most Windows policies refuse to run unsigned downloaded scripts. Without it you get: ...cannot be loaded. The file ... is not digitally signed. -ExecutionPolicy Bypass applies only to that single process — it does not change the system policy. Alternative: Unblock-File .\sentrikat-agent-windows.ps1 once, then run it normally.

Useful options

Parameter Meaning
-ServerUrl <url> Override the server URL baked into the download
-EnrollToken <t> Enroll via install token (mass deploy)
-IntervalMinutes <n> Scan interval (default 240 = 4 hours)
-ProxyUrl <url> Corporate proxy for reaching the server
-CaCertPath <path> Custom CA bundle for internal PKI
-AllowHttp Permit plain HTTP (labs only — use HTTPS)
-RunOnce Single scan now, no install
-Diagnose Connectivity/config self-check with clear output
-Uninstall Remove the scheduled tasks and local config

Verify it works

Get-ScheduledTask "SentriKat Agent"
Get-Content "$env:ProgramData\SentriKat\agent.log" -Tail 20

Within a minute the machine appears in SentriKat under Inventory → Endpoints, and its software shows up in the product list. Config lives at %ProgramData%\SentriKat\config.json.

Troubleshooting

Symptom Fix
not digitally signed on run use powershell -ExecutionPolicy Bypass -File ... (see above) or Unblock-File first
Agent installed on the server works, other machines don't connect the download baked in a localhost URL — set a network-reachable SENTRIKAT_URL in SentriKat and re-download, or pass -ServerUrl <url>
TLS errors behind corporate PKI -CaCertPath C:\path\ca.pem (or fix the machine trust store)
Anything else powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Diagnose and read the output

Uninstall

powershell -ExecutionPolicy Bypass -File .\sentrikat-agent-windows.ps1 -Uninstall