Install DISCOVER Agent
The Scanning Agent, DISCOVER Agent, or simply Agent, is the Windows service that performs scan work and reports results to the Management Console. It can be deployed in two ways, depending on whether you want each device to scan itself (local scan) or a central host to scan other devices remotely (agentless scan).
Before installing the Agent, whitelist DISCOVER and confirm the host meets the system requirements.
Install the Agent
Double-click the
.msifile to launch the installer.Click Next, then click Install.
Wait for the installation to complete.
The Scanning Agent installs and runs as a Windows background service. Once running, the scanning agent registers with the Management Console by using the device name and is ready to receive and execute instructions.
1.1 Verify the Installation
Confirm the Scanning Agent is running before proceeding:
Open Task Manager (
Ctrl + Shift + Esc).Click Processes, type GuardWare Scan Utility and confirm that it appears under Background processes.
Next, open Run, type
services.msc, and press Enter. Confirm the GuardWare scanning service is listed and running.
Confirm Registration
Open a browser and log in to the Management Console.
Navigate to DEVICES > DISCOVER.
Confirm the Scanning Server appears in the list and its status shows as Online.
If the host does not appear, confirm it can reach the Management Console host over HTTPS and that no firewall is blocking the connection.
Configure Certificate Verification
If a self-signed certificate is used, whether generated automatically by the installer or provided as a .pfx file during installation, you need to bypass certificate verification after installation.
Bypassing certificate verification disables validation of the certificate's authenticity, not the encryption itself and communication between the Scanning Server and the Management Console remains encrypted over HTTPS using SSL/TLS.
Open Registry Editor.
Navigate to
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\GuardWare\DISCOVER.Right-click and select New > String Value.
Name the value
cert_verification, set the value data to0and click OK.
Close the Registry Editor.
Configure Remote Access
If you only want to perform local scans or Microsoft 365 services, skip the Configure Remote Access section and continue to Whitelist GuardWare DISCOVER. The following step is only required if the Scanning Server will scan targets remotely (agentless scans).
To perform a remote scan, each target device must have the appropriate protocol configured to accept connections from the Management Console. GuardWare provides PowerShell scripts that enable the required services, set permissions, and configure firewall rules.
For Microsoft 365 targets the Scanning Server only needs outbound HTTPS access and valid Microsoft Entra ID (Azure AD) Global admin credentials.
Ports Required
Windows endpoints
WinRM
5985 (HTTP), 5986 (HTTPS)
Outbound from scanning server
Run the WinRM configuration script on each target.
Other endpoints
SSH
22
Outbound from scanning server
Run the OpenSSH configuration script on each target.
SMB file shares
SMB
445
Outbound from scanning server
Ensure the share is accessible with valid credentials.
Exchange Online / SharePoint Online
HTTPS
443
Outbound from scanning server
No device-side script required. Requires Microsoft Entra ID (Azure AD) Global Admin credentials.
Remote Configuration Scripts
Download and deploy the appropriate script on each target device (WinRM for Windows and SSH for other devices):
Recommended for cloud-managed or Entra ID (Azure AD)-joined devices. Go to the Intune admin center and deploy the script.
Recommended for Active Directory-joined devices. Assign as a Startup or Logon script via the Group Policy Management Console.
Run the script directly on each target device using PowerShell with administrator rights. Suitable for small environments or one-off targets.
Deploy Script via Microsoft Intune
Use this method for devices enrolled in Microsoft Intune and joined to Microsoft Entra ID (Azure AD). Devices must be running Windows 10 or 11 (version 1607 or later, excluding Home and S Mode) with .NET Framework 4.7.2 or later installed.
Open the Microsoft Intune admin center and sign in using your administrator credentials.
Go to Devices > Scripts and remediations > Platform scripts and click +Add.
Enter a Name for your script (e.g., Configure WinRM or Configure SSH), add a Description (optional), and click Next.
Click the folder icon and upload the provided PowerShell script.
Set to No to run as System (recommended for admin-level operations like remote access).
Enforce script signature check: Enable only if your script is digitally signed.
Run the script in 64-bit PowerShell: Set to Yes, then click Next.
If your organisation uses scope tags for role-based access control, add them here and click Next.
Under Included groups, click Add groups and select the Entra ID (Azure AD) user or device groups you want to target.
Optionally, configure Excluded groups and click Next.
Review your configuration, then click Create to deploy the script.
Deploy Script via Group Policy Management Console
Use this method for devices joined to an Active Directory domain. The script runs automatically on target devices depending on the policy type assigned.
Press Windows + R, type
gpmc.msc, and press Enter to open the Group Policy Management Console (GPMC).
In the GPMC console, navigate to the Organizational Unit (OU) that contains the target devices.
Right-click the OU and select Create a GPO in this domain, and Link it here.
Enter a name for the GPO (e.g., Remote Access Configuration) and click OK.
Right-click the newly created GPO and select Edit to open the Group Policy Management Editor.
To deploy the script as a Startup script (runs as System), navigate to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup.
Click Add, then Browse to select your PowerShell script, or enter the network path if stored on a shared location, and click OK to save.
To deploy the script as a Logon script (runs as the logged-in user), navigate to User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff) > Logon.
Click Add, then Browse to select your PowerShell script and click OK to save.
Close the editor, then ensure the GPO is linked to the correct OU that contains the target devices.
On a target device, open Command Prompt and run
gpupdate /forceto apply the new policy immediately, or wait for the next automatic Group Policy refresh.
Once deployed, the script executes on target devices based on the assigned policy type (Startup or Logon) and automatically applies the intended configuration.
Deploy the Script Locally
Use this method to run the configuration script directly on an individual target device. Before running the SSH script, configure SSH sessions to open in PowerShell rather than the default Command Prompt.
Set PowerShell as the SSH default shell (SSH targets only)
Open Run and type
regeditto open the Registry Editor.
Navigate to
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\OpenSSH.
Check for a string-value file named
DefaultShell. If the file is not there, right-click on a space and select New > String Value. Name the valueDefaultShelland open it.
Set the value data to:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe. If PowerShell Core is installed and preferred, you may need to enter:C:\Program Files\PowerShell\7\pwsh.exe.
Close the Registry Editor.
Run the Remote Configuration Script
Click Start, type
PowerShell, right-click it, and select Run as administrator.
Run the following commands, replacing the filename with the script you are deploying:
Close PowerShell.
Last updated