Install on Windows

Two ways to install the Windows forwarder: the wizard, which prompts for your environment ID and token, and a silent command line, which takes them as parameters. Use the wizard for a first host, use the command line for everything after that, because the command line is what your deployment tool will run.

What do I need before I start?

• Your environment ID. Find it in Stairwell. See Environments.
• A forwarder authentication token for that environment, not expired and not revoked.
• The installer package. Get the current one from Forwarder Downloads. Three packages are offered and the choice is about .NET, not features: the bundled installer includes the .NET libraries the forwarder needs, the standalone installer expects a supported runtime already on the host, and the standalone MSI is the same standalone build packaged for tools that want an MSI. Take the bundled installer unless you have a reason not to.
• Administrator rights on the target host.
• A clean connectivity result from that network. See Pre-Deployment Check.

Which host should I install on first?

Not a critical one.

The initial backscan is a full scan of the disk, and it is resource-intensive for as long as it runs. It is also front-loaded across your whole rollout: the first machines upload the most, because everything they hold is new to Stairwell, and each subsequent machine of the same kind finds far less. Treat your first few installs as the ones that absorb that cost. A lab machine or a standard build is the right first host, and a production database server is the wrong one.

Forwarder Deployment has the full deployment order and why it saves you the most.

How do I install with the wizard?

1. Copy the installer to the host and run it.
2. Enter your Environment ID and Authentication Token when prompted.
3. If you want to skip the initial backscan, clear the Perform Initial Scan checkbox. Understand what that means before you do: files will only be collected as they are written, modified, or executed from that point on, and nothing already on disk will be inventoried until a backscan runs.
4. Finish the wizard.

No restart is required.

How do I install from the command line?

Run PowerShell as administrator, change to the folder holding the installer, and run it with your environment ID and token. This example uses the bundled installer:

.\StairwellForwarderBundle-1.7.9.1.exe TOKEN="<AUTH_TOKEN>" ENVIRONMENT_ID="<ENV_ID>" /quiet /norestart /log C:\stairwell.log

Substitute the filename of the package you downloaded, since it carries the version. /quiet suppresses the interface, /norestart prevents a reboot, and /log writes an installer log you will want if anything goes wrong.

Which install parameters should I know about?

ENVIRONMENT_ID and TOKEN are required. The rest are optional, and these are the ones that come up in real deployments.

Two notes on the resource parameters. They set a starting point on the host, and a policy from the server can override them: whichever is more restrictive is what the forwarder ends up running under. And if you are tuning these per host through the installer, that is usually a sign the tuning belongs in a policy on a group instead, where it is one edit rather than a repackage. See Create and Edit Policies.

DRIVEROVERRIDES=1 deserves its own warning. It installs the forwarder without kernel presence, which means it sees process executions and library loads but not file creations, modifications, deletions, or renames. A script written, run, and deleted quickly is invisible in that mode. It is a real option for environments that require it, and it is a substantial reduction in what Stairwell can tell you.

How do I confirm the install worked?

1. Confirm the service is running. In services.msc, the Stairwell forwarder service should show as Running.
2. Log in to app.stairwell.com and open Assets.
3. Find the new asset and confirm it has a recent check-in and a registration time. See Assets.
4. Open the asset and confirm objects are arriving. This is the step that proves collection rather than registration, and it can take a few minutes to start.
5. Confirm the asset is in the environment you meant and carries the policy you meant.

If the asset registers and no objects follow, the install is fine and the network is not. Run swell verify connectivity from that machine and read Connectivity Requirements. The usual cause is a TLS-inspecting proxy or a firewall that permits the web app and not the intake endpoints.

What about antivirus and endpoint protection on the same host?

Add the forwarder's paths to the exclusion list of whatever else is watching file activity on that machine. Two products both intercepting every file operation contend with each other, and the symptom is a slow host rather than an error.

The paths to exclude in your other endpoint product are the forwarder's data directory under C:\ProgramData, its kernel driver in the Windows drivers directory, and its service executable under C:\Program Files. Include subfolders, and note that some vendors require a trailing wildcard on a directory path. swell verify compatibility reports which security products it recognizes on a host, which is the fastest way to know whose exclusion list you need to edit. See Pre-Deployment Check.

What should I read next?

• Update the Forwarders in a Group, for upgrading Windows forwarders from the console rather than repackaging an installer.
• Asset Configuration, for the policy settings that replace most per-host install tuning.
• Forwarder Downloads, for the current package and its supported Windows versions.