Getting started

Install on Windows

#Requirements

• Windows 10 or 11, or Windows Server 2016 or later (also Server Core), x64;
• PowerShell as Administrator;
• outbound HTTPS to SEK Systems, see Requirements and network.

#1. Create an installation line

1. In the console, open Agents and click Add agent.
2. Choose Windows.
3. Optional: open Manual steps (advanced) and choose the profile (observe, patch or full). It is only used when the host has no local policy yet.
4. Click Create installation line and confirm. You need the owner or admin role.

The console shows one line:

irm https://console.sek.systems/i/<code>.ps1 | iex

The code is valid for one host, for one hour, and only once.

#2. Run it on the host

Open Windows PowerShell as Administrator (right-click → Run as administrator) and paste the line. Output lines start with sec-install:. A successful run ends with:

sec-install: done: SEK Systems agent <version> runs as service SEKSupervisor on <HOST>. The host appears in the SEK Systems dashboard within a minute (an administrator approves new hosts).

#What the installer does

1. Checks that PowerShell runs as Administrator on x64, and enables TLS 1.2.

2. Downloads sec-agent.exe (current stable release), sec-supervisor.exe and the trust anchor for updates, and checks the SHA-256 of each against fixed values. It also checks the Authenticode signature: a signed file must carry the SEK Systems code-signing certificate, otherwise the installer refuses.

3. Writes the local policy C:\ProgramData\SEC\policy.toml, only if there is none yet:

   # Local policy of the SEK Systems agent: the upper bound of what the SEK Systems central may do on this host.
   profile = "patch"
   deny_units = ["SEKAgent", "SEKSupervisor", "SEKMigrate", "SECAgent", "SECSupervisor"]
   max_jobs_per_hour = 4
   allow_script = false
   

4. Installs into C:\Program Files\SEC (slots A and B behind the supervisor) and sets the folder permissions so only SYSTEM and Administrators can change them.

5. Enrolls the host once. The token stays inside the installer and the agent's environment; it never appears on a command line. An already enrolled host keeps its identity.

6. Starts the service SEKSupervisor ("SEK Systems Supervisor") and checks that it runs.

7. Cleans up: removes its temporary files and removes its own line from the PowerShell history.

Running a new line on an enrolled host updates the installation and keeps the identity.

#What gets installed

Where possible the agent seals its private key to the machine (with the TPM, or with Windows DPAPI), so a copy of the files is useless on another computer. sec-agent keys status shows how the keys are stored on this host.

#3. Approve the host

The host appears under Agents as pending. It reports its inventory, but receives no jobs until an owner or admin clicks Approve agent.

#Check the installation

Get-Service SEKSupervisor
Get-Content C:\ProgramData\SEC\agent.log -Tail 50
& "C:\Program Files\SEC\sec-supervisor.exe" status
$slot = (Get-Content "C:\Program Files\SEC\current.txt").Trim()     # slot-a or slot-b
& "C:\Program Files\SEC\$slot\sec-agent.exe" policy

More in Verify the connection.

#Errors during installation