WAI Docs Wed Aug 19 13:22:37 EDT 2026
List
Quick Start
Quick Start
User Guide
User Guide
Policies - GuardRails
Policies - GuardRails
Witness Anywhere: Remote Device Security
Witness Anywhere: Remote Device Security
Witness Attack
Witness Attack
Administrator Guide
Administrator Guide
404
404
Windows Go Binary Installation
Introduction
This guide explains how to deploy and operate the Witness Anywhere Windows binary in managed enterprise environments. By following the guidance outlined here, administrators can register devices with Witness Anywhere in a consistent, repeatable manner while maintaining clear visibility into execution status and outcomes.
Advantages over script-based approaches
- Enterprise Hardening: The Witness Anywhere binary is compiled with native Windows APIs, signed artifacts, and tamper-resistance measures that are not available in the script-based flow.
- Operational Reliability: Error handling, retry logic, and logging are built into the executable, reducing drift caused by script edits or interpreter differences.
- Streamlined Deployment: The binary runs without requiring PowerShell execution policy changes or dependency bootstrapping, enabling seamless rollout through MDM or GPO tools.
- Controlled Configuration: Feature toggles are exposed through validated command-line switches, keeping administrators in control while preventing unsupported modifications.
- Audit-Ready Logging: Structured logs are emitted in a consistent format that supports enterprise monitoring platforms and incident response workflows.
Prerequisites and Preparation
- Supported Operating Systems: Windows 10 (21H2+) and Windows 11 on 32/64-bit architectures.
- Administrative Privileges: Required to write system configuration, manage certificates, and install supporting services when enabled.
- Network Reachability: Outbound HTTPS access to Witness Anywhere platform endpoints specific to the customer tenant.
- Allow traffic to api.{tenant-id}.{region}.witness.ai on port 443
- Allow traffic to *.proxy.{tenant-id}.{region}.witness.ai on port 8443
- Allow traffic to cdn.witness.ai on port 443
- Authentication Token: A current Witness Anywhere registration token generated for the customer tenant.
Deployment Workflow
- Plan the rollout: Confirm the target device cohort, maintenance window, and any proxy or MDM requirements.
- Download the release: Download witness_anywhere.exe
- Stage the binary: Upload witness_anywhere.exe to your preferred enterprise deployment mechanism (for example, CrowdStrike, Windows Group Policy, or a similar endpoint management tool) and target the deployment to the appropriate devices or device groups.
- Prepare command syntax: Combine the required token and tenant flags with optional toggles that align to your policy.
- Execute with elevation: Run the binary using an elevated Command Prompt or PowerShell session, supplying the required and any optional parameters to initiate the device registration process.
- Review logs and status: Confirm the process exits with code 0, and verify registration by inspecting the generated log file (C:\Windows\Temp\WitnessAI\WitnessAnywhere-Reg.log).
Usage Scenarios
Entra ID Joined Physical Devices
witness_anywhere.exe -token "<JWT_TOKEN>" -tenant "1234.use1.witness.ai" -mdm "windowsgpo" -stunnel=trueEntra ID (Hybrid Join) Joined Physical Devices
witness_anywhere.exe -token "<JWT_TOKEN>" -tenant "1234.use1.witness.ai" -mdm "windowsgpo" -static-domain "corp.example.com" -stunnel=trueWitness Anywhere Removal
witness_anywhere.exe -flush=true -domain-join=trueCommand Parameters and Toggles
Use the following switches to tailor behavior. Parameters are case-sensitive and validated by the binary.
Parameter | Description |
-tenant [Mandatory] | WitnessAI tenant identifier Example: -tenant "1234.use1.witness.ai" |
-token [Mandatory] | Supplies the Witness Anywhere registration token Example: -token "ey12345-6789-0123456" |
-mdm [Mandatory] | MDM vendor type: 'windowsgpo', 'crowdstrike', 'sentinelone', 'intune' (default: windowsgpo) Example: -mdm "crowdstrike" |
-domain-join | Domain join status: true for AD/Entra joined devices (default), false for non-AD/Entra joined devices Example: -domain-join=false |
-flush | Initiates cleanup mode, removing Witness Anywhere configuration from the device. Example: -flush=true |
-log-file | Redirects output to a custom log location that meets your retention policy. (default "C:\Windows\Temp\WitnessAI\WitnessAnywhere-Reg.log") Example: -log-file "D:\Logs\WitnessAnywhere\registration.log" |
-proxy-lock | Applies a hardened proxy configuration and prevents local users from altering settings Example: -proxy-lock=true |
-static-domain | Overrides automatic domain discovery for hybrid or multi-domain deployments Example: -static-domain "corp.example.com" |
-stunnel | Enables secure tunneling for environments that require TLS wrapping or intermediary connectivity. Example: -stunnel=true |
Recommendation: Maintain a runbook or configuration management record that documents the precise flag combinations approved for each deployment cohort.
Log Review and Troubleshooting
- Default Location: The binary writes operational logs to a secured directory under the Windows temporary path (C:\Windows\Temp\WitnessAI\WitnessAnywhere-Reg.log). Use the -log-file switch when enterprise log retention policies require alternate storage.
- Format: Logs are timestamped and structured for ingestion by SIEM platforms. Sensitive data, such as tokens, is never persisted in clear text.
- Collection: Configure your log shipping agent (for example, Microsoft Defender for Endpoint, CrowdStrike Falcon, or SentinelOne) to monitor the directory and forward entries to your central log store.
- Alerting: Set alerts for non-zero exit codes, repeated registration failures, or missing stunnel confirmations when the -stunnel toggle is in use.
Sample Log Excerpt (Sanitized)
2025/09/29 12:33:12 [INFO] PAC_URL: https://api.{tenant-id}.{region}.witness.ai/v1/peas/pac/e945fa29c2c123314314d24078c111115f843444444111111.pac?enableStunnel=true2025/09/29 12:33:12 [INFO] STATIC_FQDN: e945fa29c2c123314314d24078c111115f8434444441111112025/09/29 12:33:12 [INFO] DEVICE_FINGERPRINT: feH4441343186ceec61534319732cd37a7413431573412025/09/29 12:33:13 [INFO] Phase 3: Applying system configurations...2025/09/29 12:33:13 [INFO] System proxy settings configured with PAC URL2025/09/29 12:33:16 STUNNEL DEPLOYMENT SUCCESS2025/09/29 12:33:16 Stunnel service active for: firstname.lastname2025/09/29 12:33:16 Tunnel endpoint: 127.0.0.1:94112025/09/29 12:33:16 Auto-start: Enabled2025/09/29 12:33:16 Architecture: 64-bit2025/09/29 12:33:16 Device registration completed successfullyIf errors occur, capture the log file, note the exit code displayed in the console, and provide both artifacts to WitnessAI Support through your designated case channel.Decoding Error Codes
Error Message | Reason |
failed to fetch configuration: authentication failed (HTTP 401): {"message":"Invalid signature"} | Invalid Witness Anywhere Registration Token |
Details: failed to fetch configuration: authentication failed (HTTP 401): {"exp":"token expired"} | Expired Witness Anywhere Registration Token |
Details: MDM Agent Check Failed: SentinelOne Agent not found | MDM Agent not Installed |
message":"something unexpected went wrong, please try again later: preparing the device registration failed | Generic Witness Anywhere Registration failure. Contact WitnessAI Support for assistance |
Frequently Asked Questions
- Q: Can the binary run without administrative rights?
- A: No. System changes required for registration and optional proxy or tunneling features require elevated permissions.
- Q: How should we schedule re-registration?
- A: Trigger re-registration only after completing a flush, or when directed by WitnessAI Support. Routine re-registration is not required once a device is registered successfully.
- Q: What if stunnel is not approved in our environment?
- A: Leave -stunnel at its default (false). The binary will complete registration using direct platform connectivity, provided outbound HTTPS access is available.