Install and deploy

Before you roll out#

1. Verify the installer. Every release is Authenticode-signed by Dawnstar Labs. Check it before you upload it to your deployment tool:
   PowerShellCopy

   Get-AuthenticodeSignature .\Vardhold-0.1.0-x64.msi | Format-List Status, SignerCertificate

   Status must be Valid.

2. Keep the SBOM. Each release has a CycloneDX software bill of materials (sbom.cdx.json), attached to the release and installed with the product. Keep the one for each version you deploy.
3. Pilot first. Install on a few developer machines with MODE=monitor for a week, review what the agents do, then tune the policy before you enforce it everywhere. See Start a pilot in monitor mode.

Installer options#

Standard msiexec switches apply: /qn for silent, /norestart, and /l*v for a verbose log. Vardhold does not need a restart.

msiexec /i Vardhold-0.1.0-x64.msi /qn /norestart /l*v "$env:TEMP\vardhold-install.log"

Start a pilot in monitor mode#

msiexec /i Vardhold-0.1.0-x64.msi MODE=monitor /qn /norestart

In monitor mode every agent action is recorded and every rule still matches and raises its alerts, but nothing is blocked and nothing waits for approval. The hooks also let actions through if the Vardhold service cannot be reached, because monitor mode never blocks. Developers are not interrupted while you learn what their agents do.

When you are ready to enforce, switch the mode from the dashboard or from an elevated prompt:

& "C:\Program Files\Vardhold\vardhold.exe" mode enforce

In enforce and strict the hooks fail closed again: if the service cannot be reached, agent actions are blocked. If a machine ever needs to get going again quickly, see Get a blocked machine working again.

Deploy with your tool#

$msi = "\\fileserver\software\Vardhold-0.1.0-x64.msi"
if ((Get-AuthenticodeSignature $msi).Status -ne 'Valid') { throw "Installer signature is not valid." }
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$msi`" /qn /norestart"
Get-Service Vardhold

What the installer does#

• Installs to C:\Program Files\Vardhold and creates %ProgramData%\Vardhold, limited to SYSTEM and Administrators. Anything already in that folder is taken over.
• Registers the Vardhold service (automatic start, restart on failure) and starts it.
• Registers the agent hooks you selected, machine-wide, in places only administrators can change.
• Starts the tray app for signed-in users right away, and at every sign-in after that.
• Writes the default policy on a new install. An upgrade keeps your policy, settings and audit data.

Roll out a policy to the fleet#

Write and test the policy on one machine first (the dashboard's dry run shows what it would change). Then push it with the same tool you deploy with, running the CLI as SYSTEM or an administrator:

$cli = "C:\Program Files\Vardhold\vardhold.exe"
& $cli policy validate .\org-policy.yaml
if ($LASTEXITCODE -eq 0) { & $cli policy apply .\org-policy.yaml }

Every applied policy is versioned and sealed in the audit log, with who applied it. A central console for policy distribution, fleet inventory and central approvals is on the roadmap.

Upgrade#

Install the new MSI over the old one with the same command. The upgrade replaces the binaries and keeps the policy, settings and audit data. If anything fails, Windows Installer rolls the machine back to the version that was there.

Installing Vardhold over AgentGuard, its earlier name, replaces it and cleans up the old hooks and firewall rules. The old audit data in %ProgramData%\AgentGuard is kept as evidence and stays protected.

Uninstall#

msiexec /x Vardhold-0.1.0-x64.msi /qn

Uninstalling removes the hooks first, then restores the MCP client configurations Vardhold changed and removes any firewall rules it added. The audit data in %ProgramData%\Vardhold is kept as evidence; delete it separately once your retention requirement allows.

The hooks fail closed, so one left pointing at a removed program would block every agent action. If a machine-wide hook cannot be removed, usually because something holds the file open, the uninstall stops and rolls back: Vardhold stays installed and working. Close whatever holds the file and uninstall again. A fresh installation that fails part-way removes the hooks it registered.