Windows Agent Installation

import { Aside, Steps } from ‘@astrojs/starlight/components’;

The Windows agent ships as a standard MSI installer signed by Halden Technologies. It installs as a Windows Service running as SYSTEM and starts automatically at boot.

Manual installation

msiexec /i bastion-agent-windows-x64.msi /quiet `
  BACKEND_URL="grpc://YOUR_SERVER:50051"

The agent service (BastionAgent) starts immediately after installation.

Group Policy deployment (recommended for school districts)

Download the MSI from the console under Settings → Downloads or from the GitHub release page.
Create a GPO in Group Policy Management Console (GPMC):
- Computer Configuration → Policies → Software Settings → Software Installation
- Right-click → New → Package → select the MSI
Set the backend URL via a registry key GPO:
- HKLM\SOFTWARE\Bastion\Agent
- String value: BackendUrl = grpc://YOUR_SERVER:50051
Link the GPO to the OUs containing your endpoints. The agent installs at next startup.

Microsoft Intune deployment

In Intune admin center, go to Apps → Windows → Add → Line-of-business app
Upload the MSI
Under Command-line arguments, add: /quiet BACKEND_URL="grpc://YOUR_SERVER:50051"
Assign to your device groups

Verify the installation

# Check service status
Get-Service BastionAgent

# Check logs
Get-EventLog -LogName Application -Source "BastionAgent" -Newest 20

The agent should appear in Endpoints in the console within 30 seconds.

Configuration file location

%ProgramData%\Bastion\config\agent.toml

See Agent Configuration for all available options.

Silent uninstall

msiexec /x bastion-agent-windows-x64.msi /quiet