Run as a Service

Installed as a Windows service, the Active Directory and Microsoft 365 agents become probes: they wait for the portal, run the assessments you start with Run Assessment or schedule, and send the results — without anyone having to log on to the machine.

#Why Use a Probe

• Assessments run automatically, so the Security Score is always up to date.
• You can start an assessment from the portal and follow its progress there.
• Probes update themselves to the latest version of the agent.
• The probes and their last contact are visible in Company Profile → Edit → Scheduling, and you can be notified by email if one stops responding.

#Installing the Active Directory Probe

1. Prepare the agent and config.dat in a folder of the machine, as described in Active Directory Agent.
2. From a prompt opened with "Run as administrator", run:

.\CyberGuard-ADAssessment.exe --Install --InstallCode "<installation code>"

3. Enter the domain account the service will use (DOMAIN\user) and its password. The password is typed on screen, never passed on the command line.

The installation checks the account: it must be valid and a member of Domain Admins or Enterprise Admins, otherwise the installation stops. The password is kept by Windows, in the service configuration. If the account later stops being an administrator, the probe does not run scans and reports the reason to the portal.

To change the account or its password, run --Install again: on an existing service it only asks for the new credentials.

#Installing the Microsoft 365 Probe

1. Complete the first configuration of the Microsoft 365 agent on the machine, including the certificate.
2. From a prompt opened with "Run as administrator", run:

.\CyberGuard-M365Agent.exe --Install --InstallCode "<installation code>"

The Microsoft 365 probe runs with the machine's system account and uses the certificate registered during the first configuration. Your organization can have one Microsoft 365 probe: a second installation is refused until you revoke the first one from the portal.

#Checking the Probe

In Company Profile → Edit → Scheduling, the Probes card shows each probe with its machine, agent version and last contact. A probe that does not contact the portal anymore is reported there.

#Removing a Probe

To remove a probe from a machine, from a prompt opened with "Run as administrator" run the agent with --Uninstall: it stops and removes the service and its files, and tells the portal.

If the machine is no longer available, revoke the probe from the Probes card: it stops working at its next contact.