Manual Installation

Manual installation registers the agent as a Windows service by hand, without the installer. It is intended for advanced users, or when you need configuration the dashboard installer does not expose. The steps below reproduce what the installer does: place the files, provision credentials, register the service, write the service configuration, and start it.

Prerequisites

• Build the agent binaries and the drivers from source. See Building from Source.
• A provisioning host with the enrollment-tool and a configured step-ca instance. Credentials are minted there, not on the endpoint.

ℹ️ AnyOne-Tools repository is internal to MarkAny GaneshaIT. Request access from:
Addin Munawwar (GaneshaIT)
Email / Slack: addin@ganeshait.com

Obtaining the Credentials

Every step in this section runs on the provisioning host (server side), not on the endpoint. The endpoint only receives the resulting files and values. For the full tool reference, see the AnyOne-Tools README.

The managed enrollment path needs three things on the endpoint: a device enrollment credential (certificate and key), the step-ca connection values, and the command-signing anchor public key. Mint them on the provisioning host as follows.

Create enrollment CA and provisioner

Initialise the offline enrollment CA. Keep both output files on the secured provisioning host. The key is never deployed.

enrollment-tool ca init --out /path/to/enrollment-ca/

Register the X5C provisioner with step-ca using the CA root it produced. The provisioner name must equal the CA_PROVISIONER value you set on every endpoint.

step ca provisioner add device-enrollment --type X5C --x5c-roots enrollment-ca.crt

Generate command-signing anchor key

Generate the anchor keypair. Store the private seed offline. Pin the public key on every endpoint as COMMAND_ANCHOR_PUBLIC_KEY_BASE64.

mint-trust-bundle anchor-init

The command prints anchor_private_seed_base64 (keep offline) and anchor_public_key_base64 (the value used below).

Issue an enrollment certificate (per-device)

On the provisioning host, issue a credential for the target endpoint. Use the endpoint’s hostname or another unique id as the device id.

ℹ️ In the automated dashboard install, the device id is the user’s username from the backend.

enrollment-tool cert issue \
  --device-id <hostname> \
  --ca-cert /path/to/enrollment-ca/enrollment-ca.crt \
  --ca-key  /path/to/enrollment-ca/enrollment-ca.key \
  --out /staging/<hostname>/

This produces <hostname>.crt (the certificate chain) and <hostname>.key (the plaintext key). Deliver both to the endpoint securely.

Record the step-ca values

You will need these when configuring the agent:

Placing the Files

Copy the binaries and drivers into the install directory:

C:\Program Files\AnyOne\anyone-agent.exe
C:\Program Files\AnyOne\anyone-agent-notifier.exe
C:\Program Files\AnyOne\AnyKDriver.sys
C:\Program Files\AnyOne\AnyMDriver.sys

Copy the delivered enrollment credential into the data directory, renamed to enrollment.crt and enrollment.key. Restrict the directory to SYSTEM.

C:\ProgramData\AnyOne\enrollment.crt
C:\ProgramData\AnyOne\enrollment.key

Registering the Service

Register the agent with the Service Control Manager from an elevated prompt:

sc.exe create AnyOneAgent binPath= "C:\Program Files\AnyOne\anyone-agent.exe" start= auto

ℹ️ sc.exe requires a space after each =.

Configuring the Agent

As a service, the agent reads its configuration from the service’s Environment value in the registry, which the Service Control Manager injects into the process at start. Write it with PowerShell from an elevated prompt. The service must already be registered, since this writes under its service key.

⚠️ Change the configuration lines marked by <brackets>

$svc = 'HKLM:\SYSTEM\CurrentControlSet\Services\AnyOneAgent'
New-ItemProperty -Path $svc -Name Environment -PropertyType MultiString -Force -Value @(
  # General
  'GRPC_ENDPOINT=https://gateway.anyone.example.com'
  'KERNEL_DRIVER_PATH=C:\Program Files\AnyOne\AnyKDriver.sys'
  'MINIFILTER_DRIVER_PATH=C:\Program Files\AnyOne\AnyMDriver.sys'
  'AUTO_KILL_MODE=disabled'

  # Credentials
  'CA_URL=https://<ca_url>'
  'CA_FINGERPRINT=<hex SHA-256 of the step-ca root>'
  'COMMAND_ANCHOR_PUBLIC_KEY_BASE64=<anchor public key>'
  'ENROLLMENT_CERT_SUBJECT=<device-id>'
  'CA_PROVISIONER=device-enrollment'
  'ENROLLMENT_X5C_CERT_PATH=C:\ProgramData\AnyOne\enrollment.crt'
  'ENROLLMENT_X5C_KEY_IMPORT_PATH=C:\ProgramData\AnyOne\enrollment.key'
)

The essential variables are:

ℹ️ The full annotated list of every setting and its default is in AnyOne-Endpoint repository in service/.env.example. The names are identical whether they are set as .env lines or as service Environment entries.

Running and Verifying

Start the service:

sc.exe start AnyOneAgent

On startup the agent installs and starts AnyKDriver and AnyMDriver, and opens its control channel to the gateway. Confirm the agent and both drivers are running:

sc.exe query AnyOneAgent
sc.exe query AnyKDriver
sc.exe query AnyMDriver

Each should report STATE: RUNNING.