Windows computers: see what is weak, fix it yourself, prove it monthly

What the agent reads

• Updates. Whether the operating system is current and how long any missing updates have been waiting.
• Built-in antivirus. Whether it is on, whether its definitions are current and whether real-time protection is enabled. Guardian does not replace it and does not ship its own.
• Firewall. Whether the built-in firewall is on for each network profile.
• Disk encryption. Whether the system drive and other drives are encrypted, so a lost laptop is not a lost dataset.
• Administrator accounts. Which accounts can change anything on the machine, and whether everyday users are running as administrators.
• Remote access tools. Remote desktop and third-party remote control software that is installed or listening.
• Persistence. Programs that start on their own at sign-in or on a schedule, which is where unwanted software usually hides.
• Software inventory. Installed programs and versions, matched against published lists of known weaknesses.
• Policy checks. A short baseline of settings such as screen lock, password rules and whether removable drives are allowed.
• Backup status. Whether a backup has run recently and where it went.

What it never does

• It never blocks a program, a website or a network address.
• It never deletes, quarantines or moves a file.
• It never changes a setting, installs an update or creates an account.
• It never reads the contents of documents, email or browsers, and never captures screens or keystrokes.
• It sends a signed list of findings, with no file contents, and nothing else.

The baseline, in plain words

Each computer is compared with a short checklist. If every line passes, the machine is in good shape for everyday office work.

• Updates are current.
• Built-in antivirus is on and up to date.
• The firewall is on.
• The disk is encrypted.
• The person using the computer is not an administrator on it.
• There is no remote access tool that nobody can account for.
• Nothing unexplained starts on its own.
• No installed program has a known weakness that is already being used by attackers.
• Screen lock and password rules are set.
• A backup ran recently.

Install in one line by your administrator

Your administrator creates an enrolment token in the console and runs one command on each computer, or pushes it through the device management they already use. The computer then appears in the console with its findings. Removing it is one command as well.

The agent runs as a limited service, signs everything it sends and never accepts commands from Guardian. There is no channel through which Guardian could change a computer, by design.

What your team sees

Each computer appears with its last check-in, its baseline result and its open findings. Findings are written for people: a laptop whose disk is not encrypted, an account that should not be an administrator, a program that needs updating. The organisation protection score and the monthly report include a computers section, so management can see the trend without reading each finding.

Status

The Windows agent is being built now and is on request. Request protection and tell us how many computers you have, and we will tell you where it stands. Website protection and the Linux server agent are available today.

Questions

Does the Windows agent replace our antivirus?

No. It reads whether the built-in antivirus is on and current, and reports it. Guardian does not ship antivirus and does not block or delete anything.

Can Guardian change a setting on a computer if we ask?

No. The agent has no channel for commands. Your administrator makes every change from the fix list, and the console records it as done.

Does the agent read our documents or email?

No. It reads system state such as update status, accounts and installed programs. It never reads file contents, screens or keystrokes.

Is the Windows agent available today?

It is on request while it is being built. We do not promise dates.