Windows manual install | AI Agent Security

Deploy the Pathfinder agent to Windows machines and see your first AI coding session in AI Agent Security.

Prerequisites

• You have administrator access to the tenant.
• The target machines run Windows 11, or Windows Server 2022 or later, on x64 (64-bit Intel or AMD) hardware. AI Agent Security supports Windows and macOS endpoints only, and Windows on Arm is not supported.
• You have local administrator rights on the target machines, or a software distribution tool that installs with them.
• The machines can reach your AI Agent Security console URL over HTTPS.

To inspect what AI tools send over HTTPS, each machine must trust your tenant's root certificate. There are two ways to get it there: distribute the .cer with your device management tooling (Group Policy or Intune, recommended), or let the agent install it. Both are covered below.

Choose your deployment path

All three paths end in the same state and meet at Verify HTTPS inspection is live.

Path 1: EPM Package Manager (recommended)

If you already run BeyondTrust EPM, this is the shortest path: no deployment keys to copy and no install command lines. The Deploy AI Agent Security page in PM Cloud creates the deployment key for you, and the Package Manager on each endpoint installs the agent silently.

Prerequisites:

• The BeyondTrust Package Manager, version 26.3.1 or later, deployed to the target computers. The Deploy AI Agent Security page links to the Package Manager installation page if you still need it.
• AI Agent Security deployment enabled for your PM Cloud tenant. Contact BeyondTrust if the page below does not appear.
• A PM Cloud Administrator account with Settings access.

1. Open the Deploy AI Agent Security page

In PM Cloud, go to Settings > Deploy AI Agent Security.

2. Download and distribute the root certificate

Select Download root CA certificate on the page (step 1 of the on-page instructions) and distribute the .cer to the target machines with Group Policy or Intune. The mechanics are in Distribute the root certificate below.

On this path the certificate is always distributed through your own device management. Order is flexible: agents install and enroll before the certificate arrives, and inspection stays off on a machine until it does.

3. Add computer groups and deploy

Select Add group, select the computer groups to receive the agent, and confirm. PM Cloud creates a deployment key automatically, valid for 7 days for enrollment, and hands it to the Package Manager. There is nothing to copy and no install command to run.

4. Watch the rollout

Each deployed group gets a status card on the same page showing installed, install failed, and awaiting install counts with a progress bar. Select a card for per-endpoint detail.

Endpoints pick the agent up at their next Package Manager check-in, up to about 2 hours by default. The agent enrolls itself on install.

Continue at Verify HTTPS inspection is live.

Path 2: Your own software distribution

Use this path with Intune, Group Policy, SCCM, or a similar tool. In AI Agent Security, go to Settings > Deployment and select Deploy an agent. The wizard lists four steps down the left, Trust the CA, Create a key, Install and enroll, and Test, with operating system tabs across the top. Select the Windows tab. As you go, you collect two things for your distribution tool: the MSI, and an install command with a deployment key already in it.

1. Trust the CA

The first step asks how your tenant's root certificate reaches each machine. Choose Push it with device management (recommended), select Download .cer, and push the file with Group Policy or Intune. The mechanics are in Distribute the root certificate below.

If distributing certificates yourself is not practical, choose Let the agent install it instead. See Let the agent install the certificate.

2. Create a key

On the Create a key step, enter a Name, such as windows-pilot. For a rollout, set Usage to Multiple uses, and optionally enter a limit in the Max uses box (leave it blank for unlimited). Choose an Expires after value: the default is 7 days, and the options run from 24 hours to 1 year, or No expiry. Select Create & get command.

You never copy a bare key from a dialog. The wizard puts the key into the install commands on the next step.

3. Install and enroll

On the Install and enroll step, choose MSI (Intune / GPO) as the install method and select Download MSI (x64).

Deploy the MSI with your distribution tool and run it with a silent install command. The MSI enrolls itself when it receives the key and the console URL as properties. Use this single-line form, because the install command fields in Intune, SCCM, and Group Policy run under cmd.exe, where multi-line PowerShell syntax fails:

msiexec /i "C:\PATH\TO\pathfinder-agent-VERSION-x86_64.msi" /qn /l*v C:\ProgramData\pathfinder-agent-install.log BACKEND_URL=YOUR-CONSOLE-URL DEPLOYMENT_KEY=YOUR-KEY

• BACKEND_URL and DEPLOYMENT_KEY: the agent enrolls automatically on install, so there is no per-machine terminal step. The MSI masks the key in its log.
• /l*v: writes a verbose install log to the given path. Keep it. It is the first thing to check if an install fails.
  The wizard shows the same command in PowerShell form, with your console URL and key filled in, so you can try it on one machine first. The MSI method does not check that the agent service started, so confirm the install yourself.

& "$env:ProgramFiles\BeyondTrust\Pathfinder\pathfinder-agent.exe" status

A healthy result shows Enrolled: yes, an agent ID, and your console URL with Connection: connected.

Continue at Verify HTTPS inspection is live.

Path 3: Single test machine

Use this path for a trial on one endpoint where you have local administrator rights. Go to Settings > Deployment, select Deploy an agent, and select the Windows tab. This is the same wizard as Path 2, run against one machine.

1. Trust the CA

On the Trust the CA step, choose Let the agent install it. There is nothing to download: the agent fetches and installs the certificate when it activates. See Let the agent install the certificate for what that means for your security tools.

To trust the certificate by hand instead, choose Push it with device management, select Download .cer, and run this in an elevated PowerShell session from the download folder:

certutil -addstore -f Root pathfinder-root-ca.cer

2. Create a key

On the Create a key step, enter a Name, leave Usage at One-time use, choose an Expires after value, and select Create & get command. The wizard puts the key into the install command on the next step.

3. Install and enroll the agent

On the Install and enroll step:

1. Open PowerShell as administrator. A silent install fails instead of prompting for elevation, so the session has to be elevated already.
2. Leave the install method at One command (recommended), copy the command, and run it.

The command has this shape, with your download location, key, and console URL filled in:

irm YOUR-DOWNLOAD-URL/install.ps1 | iex; Install-PathfinderAgent -Key 'YOUR-KEY' -Backend 'YOUR-CONSOLE-URL'

It downloads the MSI, verifies its checksum, installs it silently, enrolls the machine, and confirms that the agent service started. If it fails, for example when anti-virus software quarantines the installer, the verbose install log is at C:\ProgramData\pathfinder-agent-install.log.

To read the script before you run it, choose Downloaded script instead, select Download install.ps1, and run the command the wizard shows. It performs the same install, enrollment, and service check.

If the agent is already installed without a key, expand Already installed without a key? Enroll it and run the enroll command it shows:

& "$env:ProgramFiles\BeyondTrust\Pathfinder\pathfinder-agent.exe" enroll --key YOUR-KEY --backend YOUR-CONSOLE-URL

When the agent checks in, the step shows the machine's hostname followed by enrolled, without a page refresh. Continue to the Test step.

Continue at Verify HTTPS inspection is live.

Distribute the root certificate

Paths 1 and 2 use this section. Distribute the downloaded .cer to the Local Machine > Trusted Root Certification Authorities store on each machine.

Get-ChildItem Cert:\LocalMachine\Root | Where-Object Subject -like "*Pathfinder*"

Order does not matter. The certificate can arrive before or after the agent. The agent checks again automatically and turns inspection on as soon as the certificate is trusted, with no reinstall.

Verify HTTPS inspection is live

On an enrolled machine, in an elevated PowerShell session:

Test-Path C:\ProgramData\BeyondTrust\Pathfinder\tls-intercept-ready

The agent checks the chain again every minute while it runs. If the root certificate is removed, the agent puts it back. Until it is back, inspected apps see certificate errors (inspection does not switch off), and the removal is reported. If the intermediate certificate expires and cannot be renewed, the marker disappears and traffic passes through uninspected rather than failing.

False almost always means the root certificate is not trusted on this machine yet, because distribution has not reached it. The agent is otherwise fully functional and checks again automatically. As soon as the certificate arrives, inspection goes live with no reinstall. See Troubleshooting.

Run a first session

Coding hooks let AI Agent Security see and govern individual AI tool calls. No install step is needed: the installer already set up machine-wide hooks for all four supported assistants (Claude Code, Codex, Cursor, and GitHub Copilot) for every user on the machine.

On a machine where Claude Code is installed and signed in, run a short session:

claude -p "Create a file named pathfinder-test.txt containing the word hello"

The wizard's Test step has the matching command for each assistant, plus a shell smoke test and a broader prompt. See Coding hooks: install and verify.

The machines are now enrolled, inspecting, and reporting AI activity.

Next step: go to Protection > Policies, select New policy, and attach the policy to your endpoints, as the warning above describes.

Let the agent install the certificate

This applies to Paths 2 and 3 only. On the EPM path, distribute the certificate as shown in Path 1.

If you skipped certificate distribution, the agent installs the tenant root itself the first time it starts. It receives the certificate over its authenticated enrollment channel and writes it to the machine trust store. There is nothing extra to deploy, and the standard install command is all it takes.

Before you choose this path, consider the following:

• Your EDR may flag it. Adding a trusted root programmatically is a technique security tools watch for (MITRE ATT&CK T1553.004). Give your SOC the downloaded .cer, or its thumbprint, in advance so they can allowlist the event.
• Uninstall is symmetric. A root the agent installed is removed when the agent is uninstalled. A root you distributed with Group Policy or Intune is never touched.
• If your PKI or security team owns trust-store changes, distribute the certificate yourself instead. That is why it is the recommended path.

Either path ends in the same state.

Troubleshooting

Nothing here breaks user traffic. Until the certificate chain is verified on a machine, HTTPS passes through encrypted and untouched, and the machine is not inspected yet.