Enroll a Windows endpoint

The agent sends the machine’s Windows Security, System and Sysmon logs to the platform, and carries out response commands an analyst has had approved: isolating the machine, ending a process, switching USB storage off. It runs as the Windows service LegitAIEndpointSensor.

Before you start

You need the ADMIN role in the console, an administrator account on the Windows machine (Windows 10, 11 or Windows Server), and HTTPS from that machine to the platform’s address.

Get the command from the console

1. Open Admin → Endpoints and choose Add endpoint.

2. Choose Generate enrollment command. The console creates a token for your tenant and builds the command around it.

3. Copy the command. The token in it is shown only this once. It stays valid for any number of machines until you revoke it in the same window, so revoke it once your rollout is done.

Run it as administrator

Open PowerShell with Run as administrator on the Windows machine and paste the line. It looks like this:

PowerShell — administrator

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; iwr "https://soc.example.com/api/agents/installer?token=<token>" -OutFile "$env:TEMP\legit-install.ps1" -UseBasicParsing; & "$env:TEMP\legit-install.ps1" -ServerUrl "https://soc.example.com" -EnrollmentToken "<token>"

The installer and agent.exe both come from your platform server; nothing is fetched from the internet. The execution policy is relaxed for this PowerShell window only, and the machine’s own policy applies again once the window closes.

The installer then does four things, in this order:

Step	What happens
Register	The server assigns the agent its ID and API key. The key is stored in a folder only SYSTEM and administrators can read. Running the installer again on the same machine keeps the same ID.
Audit policy	Turns on two audit subcategories Windows leaves off by default: Process Creation (event 4688, with the command line) and PNP Activity (event 6416, removable devices).
Files	Copies the agent to C:\Program Files\LegitAI and keeps its configuration, key and queue in C:\ProgramData\LegitAI. An earlier install is upgraded in place.
Service	Installs and starts LegitAIEndpointSensor.

Domain-joined machines

Group Policy owns the audit settings there and puts them back at its next refresh. Enable both subcategories in a GPO (Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration), or process and USB events stop arriving a few hours after install.

Install from media

When the machine may not download from the server, choose Download the offline package (.zip) in the same window after generating the command. The zip holds agent.exe, install_windows.ps1, the Sysmon settings and a README with the exact command for your server and token. Copy it over on removable media, unpack it and run the installer from that folder. It finds agent.exe beside itself and downloads nothing; it still contacts the server once to register.

Many machines at once: Deploy to many machines.

PowerShell — administrator

.\install_windows.ps1 -ServerUrl "https://soc.example.com" -EnrollmentToken "<token>"

Parameter	Required	Default
-ServerUrl	Yes	—
-EnrollmentToken	Yes	—
-InstallDir	No	C:\Program Files\LegitAI
-DataDir	No	C:\ProgramData\LegitAI

Add Sysmon

The installer does not install Sysmon: it is Microsoft’s own tool, distributed by Microsoft. With it, the agent also sees network connections from script hosts and binaries in user-writable folders, access to LSASS, persistence keys in the registry, files dropped into startup and document folders, and DNS queries.

The Legit AI configuration is deliberately narrow, written so that one server can take the volume. Process creation is off in it, because event 4688 already reports every process; image loads are off (thousands a minute on a desktop); file deletion is off, because Sysmon would archive every deleted file to disk. Download it from your server with the same token:

PowerShell — administrator

iwr "https://soc.example.com/api/agents/installer/sysmon-config.xml?token=<token>" -OutFile legitai-sysmon.xml -UseBasicParsing
Sysmon64.exe -accepteula -i legitai-sysmon.xml

Sysmon can go on before or after the agent. The agent keeps looking for the Sysmon channel and starts reading it as soon as it exists.

Check that it is collecting

The agent reports in every 60 seconds, so the machine appears under Admin → Endpoints within a minute. Each report carries the state of its collectors, so the console shows whether the machine is actually collecting, not only whether the agent is alive.

On the machine itself:

PowerShell

Get-Service LegitAIEndpointSensor
Get-EventLog -LogName Application -Source LegitAIEndpointSensor -Newest 20

Collecting is not the same as delivering. If the machine collects but its events do not reach the server, the endpoint shows Not delivering instead of a green status, and the endpoint’s details say since when and why. Last delivered shows when its events last arrived. While the server cannot be reached, events wait on the machine and are sent once it can be reached again.

An agent from before version 1.1.5 whose status is Not delivering with a full queue: run the command from Get the command from the console on the machine again. It updates the agent in place, keeps its enrolment and frees the queue.