Windows Server 2016 to 2025 and Windows 10 and 11, from one console on your own server. Patch Tuesday in rings, BitLocker keys you cannot lose, local admin passwords without Active Directory, and CMMC evidence from the same agent. Flat yearly price.
| The job | In Gardience |
|---|---|
| Find what is missing | Each machine runs its own Windows Update search, the same list Windows itself shows, from Microsoft or from your WSUS |
| Patch Tuesday | A built-in workflow patches the pilot ring, checks it, then patches the broad ring with the same tested set |
| Updates that wait for a restart | Patch, restart when needed, patch again, up to three passes, so a cumulative update that needs a reboot actually finishes |
| Third-party apps | Chrome, 7-Zip, Zoom, Adobe Reader, and every other app with a newer version in the public winget catalog, across the fleet |
| Change control | Change windows, locks, two-person approval, and every machine's result in a tamper-evident audit log |
| Machines with no internet | Scanned against Microsoft's offline update catalog |
Turn on BitLocker with the TPM and XTS-AES 256, and every recovery key is kept in Gardience. Machines encrypted before Gardience get their keys backed up too.
Every machine gets its own long random Administrator password, changed on a schedule, found by its well-known ID even if it was renamed. No Active Directory needed. Each view needs a reason and goes in the audit log.
AppLocker or App Control for Business, started in audit mode, reviewed, then enforced from the console. Gardience's agent keeps working under enforcement.
Microsoft Defender, or CrowdStrike, SentinelOne, and 20 more products, recognized as malware protection. Alerts when a security service stops.
STIG and CIS-aligned checks such as the firewall on every profile, Defender real-time protection, and AutoPlay off, with a one-click fix and drift repair.
Every CVE on every machine, known-exploited ones from CISA's catalog first, the rest ranked by how likely they are to be attacked, and fixed by installing the exact KBs.
Run your Ansible playbooks on Windows over Gardience's own connection, with no WinRM listeners and no stored Windows passwords. Ask every machine a question, such as installed software, local administrators, who is signed in, or pending restarts, and get answers in seconds.
Gardience reads Active Directory, Okta, Microsoft 365, and your HR system's termination report, read only, and turns machine settings into evidence for the 110 requirements. CMMC in detail.
Windows Server 2016, 2019, 2022, and 2025, and Windows 10 and 11, each verified on real machines with the full product. Every supported platform.
Does it replace WSUS? Yes, approvals, rings, and patch reports included. WSUS alternative.
Do I need Azure or Intune? No. Gardience runs entirely on your own server, including networks with no internet.
Linux too? Yes, in the same console, on the same schedule. Gardience for Linux.
Can I try it on my own machines? Yes. The free license covers 10 machines with no time limit, and the trial covers the full product.