Documentation / Getting started
Deploying agents
The endpoint agent installs silently, enrols against your deployment, and reports what it can and cannot see.
Getting the installer
Download from Settings → Agents. The installer is signed and carries an enrolment token scoped to one client. Tokens expire; an expired token is refused rather than accepted with a warning.
Silent install
msiexec /i dg-agent.msi /qn ENROLL_TOKEN=<token>
macOS
sudo installer -pkg dg-agent.pkg -target /
Linux
sudo dpkg -i dg-agent.deb && sudo dg-agent enrol --token <token>
Deploy through your existing tooling — GPO, Intune, a package manager, or the platform's own deployment once one machine is enrolled.
What it collects
- Hardware, OS, uptime, logged-on users
- Installed software and patch state
- Drive health including SMART where the hardware exposes it
- Service and process state
- Logon history — interactive, remote and network
What it does not do
The agent never records keystrokes, screen content, browsing, application usage time, or anything that could be used to measure a person's productivity. That is a structural property, not a setting.
Enrolment troubleshooting
| Symptom | Cause |
|---|---|
| Token refused | Expired, or issued for a different client |
| Enrols then goes quiet | Outbound to the collector blocked — check port and firewall |
| Reports partial inventory | Insufficient privilege; the agent names which collector failed rather than omitting it |
| Duplicate asset | Hardware identity changed — merge from the asset record, never delete |
Not running it yet? Start a thirty-day evaluation — read-only, on your own estate, no card.
What the agent can do
Forty-two declared verbs, each on the autonomy ladder with its risk tier. There is no unlisted capability — a verb that skipped the declaration would be invokable and ungated, which is the one thing the design does not permit.
Read: processes, services, drives, adapters, printers, event log, login history, system info, file browse, ping, traceroute, speed test, packet capture.
Act: deploy and uninstall patches, third-party software, service control, process termination, registry read and write, scripts, reboot, wake on LAN, host isolation and restore.
Assist: remote session, remote input, remote shell, file transfer, chat, and notifications.
The packet capture is the same engine the site collector uses — one implementation, two callers. It requires a duration, a byte cap and a filter it can actually apply, and refuses a filter it cannot enforce rather than recording everything under a label saying it did not. It returns the kernel's own drop counters, so the analysis can say what it missed.
Screen access and remote input sit at the highest tier, every session is written to the ledger, and no setting makes them silent.
The endpoint agent carries forty-two declared verbs, remote control included, and a privacy boundary enforced in the database rather than promised in a policy. What it can and cannot do.
Not running it yet? Start a thirty-day evaluation — read-only, on your own estate, no card.
Thirty days · read-only · no card
Run it beside what you already have, against your real clients. It tells you what your tools are reporting that is not true.