Deploying on Windows

Supports Windows 10, 11, and Server 2016+ (64-bit). The agent runs as a Windows Service (GTGuardianAgent) under the Local System account, so it starts on boot and keeps running when nobody is signed in.

Graphical installer (recommended)

1. Go to Deploy Agent in the dashboard.
2. Click Download .exe Installer.
3. Run it on the target machine and approve the Windows administrator prompt.
4. Paste your enrollment token and hub address when asked.

The hub address may be typed with or without https://; without it, https:// is assumed. If the installer reports that it could not write its configuration, the message under it says why (for example, a token with a space in it). Fix that value and run the installer again.

Silent installs (IT-managed rollouts)

Both installers can run with no screens, for Group Policy, Intune, SCCM, or an RMM tool. Run them from an elevated prompt.

Setup program (.exe):

.\gt-guardian-agent-setup.exe /S /TOKEN=<your-token> /HUBURL=https://guardian.example.com

Windows Installer package (.msi):

msiexec /i gt-guardian-agent.msi ENROLLMENT_TOKEN=<your-token> HUB_URL=https://guardian.example.com /qn

Reinstalling or upgrading over an existing install keeps the machine’s identity, so it does not appear twice in your fleet.

Terminal / headless install

For remote installs via RMM or a deployment script, copy the PowerShell command shown on the Deploy Agent page and run it as Administrator:

(Invoke-WebRequest https://downloads.gtarsenals.com/install.ps1?token=<your-token> -UseBasicParsing).Content | powershell -command -

This downloads the agent to %ProgramFiles%\GT Guardian Agent, writes its configuration, and registers and starts the GTGuardianAgent service. The end result is the same as the graphical installer.

What the installer sets up

• The program in %ProgramFiles%\GT Guardian Agent.
• The agent’s configuration and private key in %ProgramData%\GTGuardian. Only SYSTEM and Administrators can open that folder, because it holds the key the agent uses to prove its identity to the hub.
• A service that Windows restarts by itself within seconds if the agent process is ever ended, and a log file in the data folder.

If someone stops the agent

The hub tells you when a monitoring agent stops, including when someone ends it from Task Manager or stops the service. See Agent health and stopped agents.

Optional: switch-topology discovery

The agent works fully without this. It is only for the passive LLDP/CDP switch-topology listening Guardian Flow uses. Install Npcap (free, default options) on the machine, in any order relative to the agent install. Guardian never bundles or silently installs Npcap; it is a separate, deliberate step, the same as installing it for Wireshark.

Verify it worked

Check Agents in the dashboard. The new machine should appear within about 30 seconds. On the machine itself:

Get-Service GTGuardianAgent

It should show Running.

Uninstalling

From the dashboard, use Agents → (device) → Remove to unregister it from your fleet. On the machine itself, uninstall it the normal Windows way (Settings → Apps → GT Guardian Agent → Uninstall), or run:

& "$env:ProgramFiles\GT Guardian Agent\uninstall.exe" /S
msiexec /x gt-guardian-agent.msi /qn

(Use the first line for the setup program and the second for the MSI.) Uninstalling announces itself to the hub, so a planned removal does not raise a “service was stopped” alert. It removes the program, the service and the agent’s data folder, including its key.