Enroll desktops and laptops

Gardience manages Windows 10 and 11 computers the same way as servers: patching, CVE fixes, the security baseline, CMMC settings, and BitLocker. To put the agent on many computers at once, push one PowerShell script with the tool you already use.

Get the script#

1. Open Machines > Add machines.
2. Create an enrollment: give it a label (for example "Office computers") and make it last as long as the rollout, up to 90 days.
3. Download its Windows script, gardience-enroll.ps1.

The script installs the pinned Salt agent (after checking the installer's SHA-256 checksum), points it at this server, and joins without a manual approval while the enrollment is open. It runs silently, needs no one at the computer, and is safe to run again: a computer that already has the agent is only checked.

The script holds the enrollment token, so treat it like a password, and close the enrollment when the rollout is done (see Enrollment tokens).

Push it#

Microsoft Intune

1. In the Intune admin center, open Devices > Scripts and remediations > Platform scripts > Add > Windows 10 and later.
2. Upload gardience-enroll.ps1.
3. Set Run this script using the logged on credentials to No (it runs as SYSTEM), Enforce script signature check to No, and Run script in 64 bit PowerShell Host to Yes.
4. Assign it to a device group.

Group Policy

1. Copy gardience-enroll.ps1 to a share that computers can read (for example the domain's NETLOGON share).
2. In a Group Policy object linked to the computers' OU, open Computer Configuration > Policies > Windows Settings > Scripts > Startup, and add the script on the PowerShell Scripts tab.

Computers run it as SYSTEM at their next start.

An RMM tool (NinjaOne, Datto RMM, N-able, ConnectWise Automate, and others): run the script as a PowerShell script, as SYSTEM, on the computers or a device group.

One computer by hand: run it in PowerShell as Administrator.

Computers appear under Machines > All machines as they join.

Laptops away from the office#

The agent connects out to the Gardience server on TCP ports 4505 and 4506; nothing connects in to the laptop. Laptops need a way to reach those ports when they are away: your VPN, or a firewall rule that allows them from the addresses your laptops use. Do not open the ports to the whole internet.

While a laptop is offline, Gardience does not fail the work aimed at it. Patch runs, fixes, and CMMC settings for it are held and run when it connects again. See Held work. Until then the dashboard keeps its last scan, marked stale.

Desktops and Laptops groups#

Each agent reports what it runs on, and Gardience has three built-in groups for it:

Use them for patch rings (for example, desktops a day after the pilot), for the CMMC assessment scope (Security > CMMC Level 2, System profile), and for disk encryption: laptops are the machines most likely to be lost or stolen, so encrypt them first (Security > Disk encryption).

Good to know#

• Windows 10 and 11 Home has no BitLocker management and cannot join a domain: use Pro, Enterprise, or Education for computers that handle CUI.
• On computers joined to a domain, the domain's Group Policy wins over a local setting Gardience makes: set those policies in the domain too, or the next policy refresh undoes the change.