Ctrlk
Contact UsVisit GuardWare
linkedinyoutube
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Install DISCOVER Agent

The Scanning Agent, DISCOVER Agent, or simply Agent, is the Windows service that performs scan work and reports results to the Management Console. It can be deployed in two ways, depending on whether you want each device to scan itself (local scan) or a central host to scan other devices remotely (agentless scan).

Before installing the Agent, whitelist DISCOVER and confirm the host meets the system requirements.

1

Install the Agent

  1. Double-click the .msi file to launch the installer.

  2. Click Next, then click Install.

  3. Wait for the installation to complete.

The Scanning Agent installs and runs as a Windows background service. Once running, the scanning agent registers with the Management Console by using the device name and is ready to receive and execute instructions.

1.1 Verify the Installation

Confirm the Scanning Agent is running before proceeding:

  1. Open Task Manager (Ctrl + Shift + Esc).

  2. Click Processes, type GuardWare Scan Utility and confirm that it appears under Background processes.

  1. Next, open Run, type services.msc, and press Enter. Confirm the GuardWare scanning service is listed and running.

2

Confirm Registration

  1. Open a browser and log in to the Management Console.

  2. Navigate to DEVICES > DISCOVER.

  3. Confirm the Scanning Server appears in the list and its status shows as Online.

If the host does not appear, confirm it can reach the Management Console host over HTTPS and that no firewall is blocking the connection.

3

Configure Certificate Verification

If a self-signed certificate is used, whether generated automatically by the installer or provided as a .pfx file during installation, you need to bypass certificate verification after installation.

Bypassing certificate verification disables validation of the certificate's authenticity, not the encryption itself and communication between the Scanning Server and the Management Console remains encrypted over HTTPS using SSL/TLS.

  1. Open Registry Editor.

  2. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\GuardWare\DISCOVER.

  3. Right-click and select New > String Value.

  4. Name the value cert_verification , set the value data to 0 and click OK.

  5. Close the Registry Editor.

4

Configure Remote Access

If you only want to perform local scans or Microsoft 365 services, skip the Configure Remote Access section and continue to Whitelist GuardWare DISCOVER. The following step is only required if the Scanning Server will scan targets remotely (agentless scans).

To perform a remote scan, each target device must have the appropriate protocol configured to accept connections from the Management Console. GuardWare provides PowerShell scripts that enable the required services, set permissions, and configure firewall rules.

For Microsoft 365 targets the Scanning Server only needs outbound HTTPS access and valid Microsoft Entra ID (Azure AD) Global admin credentials.

Ports Required

Target type
Protocol
Port(s)
Direction
Notes

Windows endpoints

WinRM

5985 (HTTP), 5986 (HTTPS)

Outbound from scanning server

Run the WinRM configuration script on each target.

Other endpoints

SSH

22

Outbound from scanning server

Run the OpenSSH configuration script on each target.

SMB file shares

SMB

445

Outbound from scanning server

Ensure the share is accessible with valid credentials.

Exchange Online / SharePoint Online

HTTPS

443

Outbound from scanning server

No device-side script required. Requires Microsoft Entra ID (Azure AD) Global Admin credentials.

Remote Configuration for Linux

Follow the steps or download and execute the script given below to configure and enable remote configuration for Linux (Ubuntu/Debian/openSUSE) devices:

If you wish to automate the entire process, download and execute the script given below or, follow the manual process.

setup-ssh-debian.sh
2KB
Open

  1. Install the SSH server

sudo apt update
sudo apt install -y openssh-server

  1. Enable it at boot

sudo systemctl enable ssh

  1. Start it

sudo systemctl start ssh

  1. Verify

sudo systemctl status ssh

or

ss -tlnp | grep :22

You should see something listening on port 22.

  1. Allow SSH through the firewall (if UFW is enabled)

sudo ufw allow ssh
sudo ufw reload

If you wish to automate the entire process, download and execute the script given below or, follow the manual process.

setup-ssh-opensuse.sh
2KB
Open

  1. Install OpenSSH (usually already installed)

  1. Enable the service

  1. Start it

  1. Verify

or

  1. Open the firewall. If using firewalld:

Remote Configuration for Windows

To enable remote management on Windows devices, you can choose to configure either WinRM or OpenSSH.

WinRM Configuration

Download and run the script as administrator to allow it to enable WinRM on your Windows device.

WinRM Configuration.ps1
4KB
Open

SSH Configuration

Download both files in the same folder and double-click the .bat file to execute the script and enable SSH on your Windows device.

Install-OpenSSH.ps1
15KB
Open
Install OpenSSH.bat
353B
Open

Remote Configuration Script Deployment Methods

Microsoft Intune

Recommended for cloud-managed or Entra ID (Azure AD)-joined devices. Go to the Intune admin center and deploy the script.

Group Policy (GPMC)

Recommended for Active Directory-joined devices. Assign as a Startup or Logon script via the Group Policy Management Console.

Local Deployment

Run the script directly on each target device using PowerShell with administrator rights. Suitable for small environments or one-off targets.

Deploy Script via Microsoft Intune

Use this method for devices enrolled in Microsoft Intune and joined to Microsoft Entra ID (Azure AD). Devices must be running Windows 10 or 11 (version 1607 or later, excluding Home and S Mode) with .NET Framework 4.7.2 or later installed.

  1. Open the Microsoft Intune admin center and sign in using your administrator credentials.

  2. Go to Devices > Scripts and remediations > Platform scripts and click +Add.

  1. Enter a Name for your script (e.g., Configure WinRM or Configure SSH), add a Description (optional), and click Next.

  1. Click the folder icon and upload the provided PowerShell script.

    1. Set to No to run as System (recommended for admin-level operations like remote access).

    2. Enforce script signature check: Enable only if your script is digitally signed.

    3. Run the script in 64-bit PowerShell: Set to Yes, then click Next.

  1. If your organisation uses scope tags for role-based access control, add them here and click Next.

  2. Under Included groups, click Add groups and select the Entra ID (Azure AD) user or device groups you want to target.

  1. Optionally, configure Excluded groups and click Next.

  1. Review your configuration, then click Create to deploy the script.

Deploy Script via Group Policy Management Console

Use this method for devices joined to an Active Directory domain. The script runs automatically on target devices depending on the policy type assigned.

  1. Press Windows + R, type gpmc.msc, and press Enter to open the Group Policy Management Console (GPMC).

  1. In the GPMC console, navigate to the Organizational Unit (OU) that contains the target devices.

  2. Right-click the OU and select Create a GPO in this domain, and Link it here.

  1. Enter a name for the GPO (e.g., Remote Access Configuration) and click OK.

  1. Right-click the newly created GPO and select Edit to open the Group Policy Management Editor.

  1. To deploy the script as a Startup script (runs as System), navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup.

  1. Click Add, then Browse to select your PowerShell script, or enter the network path if stored on a shared location, and click OK to save.

  1. To deploy the script as a Logon script (runs as the logged-in user), navigate to User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) > Logon.

  1. Click Add, then Browse to select your PowerShell script and click OK to save.

  1. Close the editor, then ensure the GPO is linked to the correct OU that contains the target devices.

  2. On a target device, open Command Prompt and run gpupdate /force to apply the new policy immediately, or wait for the next automatic Group Policy refresh.

Once deployed, the script executes on target devices based on the assigned policy type (Startup or Logon) and automatically applies the intended configuration.

Deploy the Script Locally

Use this method to run the configuration script directly on an individual target device. Before running the SSH script, configure SSH sessions to open in PowerShell rather than the default Command Prompt.

Set PowerShell as the SSH default shell (SSH targets only)

  1. Open Run and type regedit to open the Registry Editor.

  1. Navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH.

  1. Check for a string-value file named DefaultShell. If the file is not there, right-click on a space and select New > String Value. Name the value DefaultShell and open it.

  1. Set the value data to: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. If PowerShell Core is installed and preferred, you may need to enter: C:\Program Files\PowerShell\7\pwsh.exe.

  1. Close the Registry Editor.

Run the Remote Configuration Script

  1. Click Start, type PowerShell , right-click it, and select Run as administrator.

  1. Run the following commands, replacing the filename with the script you are deploying:

  1. Close PowerShell.

PreviousSystem and Port Requirements for DISCOVER
NextWhitelist INSIGHT

Last updated