Windows Installation

This guide covers installing the Tamandua EDR agent on Windows systems using both the graphical MSI installer and silent command-line installation.

Prerequisites

System Requirements

Administrative Requirements

• Administrator privileges required for installation
• Network access to the Tamandua server (default: agents.tamandua.treantlab.org:8443)
• Enrollment token from the Tamandua admin console

Firewall Configuration

Ensure the following outbound connections are allowed:

For self-hosted deployments, configure your server addresses accordingly.

Download the Agent

1. Log in to the Tamandua admin console
2. Navigate to Settings > Agents > Downloads
3. Download the Windows installer:

• tamandua-agent-x64.msi for 64-bit systems
• tamandua-agent-arm64.msi for ARM64 systems

Alternatively, download using PowerShell:

# Download latest agent (x64)
Invoke-WebRequest -Uri "https://tamandua.treantlab.org/downloads/agent/windows/x64/tamandua-agent.msi" `
    -OutFile "tamandua-agent.msi"

# Verify checksum (recommended)
$hash = Get-FileHash -Path "tamandua-agent.msi" -Algorithm SHA256
Write-Host "SHA256: $($hash.Hash)"

MSI Installer (Interactive)

Step 1: Run the Installer

1. Right-click tamandua-agent.msi and select Run as administrator
2. If prompted by User Account Control (UAC), click Yes

Step 2: Accept License Agreement

1. Read the End User License Agreement
2. Check I accept the terms in the License Agreement
3. Click Next

Step 3: Enter Enrollment Token

1. Enter your Enrollment Token (obtained from the admin console)
2. Optionally customize:

• Server URL: Change only for self-hosted deployments
• Installation Path: Default is C:\Program Files\Tamandua

1. Click Next

Step 4: Select Components

Click Next after selecting components.

Step 5: Complete Installation

1. Click Install to begin installation
2. Wait for the installer to complete (typically 30-60 seconds)
3. Click Finish

The agent service starts automatically after installation.

Silent Installation (Command Line)

The current MSI installs an unprovisioned agent. It rejects token, enrollment,

mTLS, and rotation secrets supplied as MSI properties. Provision it afterward

through a governed channel or use the direct binary enrollment flow below.

Basic Silent Install

# Run as Administrator
msiexec /i tamandua-agent.msi /qn

Full Silent Install with All Options

msiexec /i tamandua-agent.msi /qn /l*v install.log `
    SERVER_URL="wss://agents.tamandua.treantlab.org:8443/socket/agent" `
    INSTALLFOLDER="C:\Program Files\Tamandua" `
    INSTALL_DRIVER=1

MSI Properties Reference

Do not pass TOKEN, AGENT_TOKEN, ENROLLMENT_TOKEN, certificate paths, or

private keys as MSI properties. The current MSI rejects those inputs.

Using the Agent Binary Directly

For advanced scenarios, you can use the agent binary's built-in installer:

# Run as Administrator
& "C:\path\to\tamandua-agent.exe" install `
    --server "wss://agents.tamandua.treantlab.org:8443/socket/agent" `
    --name "TamanduaAgent"

Install Command Options

Automation must deliver the token directly on standard input with

--token-stdin; it must not place the token in a PowerShell command string or

the child process argument list.

Verify Installation

Check Service Status

# Check if service is running
Get-Service -Name "TamanduaAgent"

# Expected output:
# Status   Name               DisplayName
# ------   ----               -----------
# Running  TamanduaAgent      Tamandua EDR Agent

Check Driver Status (if installed)

# Check minifilter driver
fltmc filters | Select-String "tamandua"

# Expected output:
# tamandua             388100         0         0           0           Frame

Check Service Recovery Configuration

# Verify recovery actions
sc qfailure TamanduaAgent

# Expected output:
# [SC] QueryServiceConfig2 SUCCESS
# SERVICE_NAME: TamanduaAgent
#         RESET_PERIOD (in seconds)    : 86400
#         REBOOT_MESSAGE               :
#         COMMAND_LINE                 :
#         FAILURE_ACTIONS              : RESTART -- Delay = 5000 milliseconds.
#                                        RESTART -- Delay = 10000 milliseconds.
#                                        RESTART -- Delay = 30000 milliseconds.

Verify Agent Connectivity

# Check agent logs
Get-Content "C:\ProgramData\Tamandua\logs\agent.log" -Tail 20

# Look for successful connection message:
# INFO tamandua_agent::transport: Connected to backend server

Verify in Admin Console

1. Log in to the Tamandua admin console
2. Navigate to Agents > All Agents
3. Confirm the new agent appears with status Online

Directory Structure

After installation, the following directory structure is created:

C:\Program Files\Tamandua\
    tamandua-agent.exe      # Agent executable
    tamandua.sys            # Kernel driver (if installed)
    TamanduaTray.exe        # System tray application (if installed)

C:\ProgramData\Tamandua\
    config\
        agent.toml          # Agent configuration
        cert.pem            # Agent certificate
        key.pem             # Agent private key (protected)
        ca-bundle.pem       # CA certificate bundle
    logs\
        agent.log           # Agent logs (rotated)
    models\
        malware_smell.onnx  # ML model (if enabled)
    rules\
        yara\               # YARA rules
        sigma\              # Sigma rules
    quarantine\             # Quarantined files
    journal\                # File modification journal

Troubleshooting

Installation Fails with "Access Denied"

Cause: Installer not running with administrator privileges. Solution:

# Run PowerShell as Administrator, then:
Start-Process msiexec -ArgumentList "/i tamandua-agent.msi /qn" -Verb RunAs

Service Fails to Start

Cause: The MSI leaves the agent unprovisioned, or network connectivity is unavailable. Solution:

1. Complete enrollment through the governed post-install channel or direct binary flow
2. Check network connectivity to the server:

   Test-NetConnection -ComputerName agents.tamandua.treantlab.org -Port 8443
   

1. Review the agent log:

   Get-Content "C:\ProgramData\Tamandua\logs\agent.log" -Tail 50
   

Driver Fails to Load

Cause: Secure Boot or driver signing issues. Solution:

1. Verify the driver is properly signed:

   Get-AuthenticodeSignature "C:\Program Files\Tamandua\tamandua.sys"
   

1. Check if Secure Boot is blocking:

   Confirm-SecureBootUEFI
   

1. The agent functions without the driver but with reduced telemetry capabilities

Agent Not Appearing in Console

Cause: Enrollment failed or agent cannot reach server. Solution:

1. Check agent logs for enrollment errors:

   Select-String -Path "C:\ProgramData\Tamandua\logs\agent.log" -Pattern "enrollment|error"
   

1. Verify DNS resolution:

   Resolve-DnsName tamandua.treantlab.org
   

1. Re-enroll the agent:

   & "C:\Program Files\Tamandua\tamandua-agent.exe" install
   

High CPU Usage

Cause: Agent running with aggressive profile or resource governor disabled. Solution:

1. Check current profile in config:

   Get-Content "C:\ProgramData\Tamandua\config\agent.toml" | Select-String "performance_profile"
   

1. Switch to balanced or lightweight profile:

   # Edit config or push new config from admin console
   performance_profile = "balanced"
   

Uninstall

Interactive Uninstall

1. Open Settings > Apps > Installed apps
2. Find Tamandua EDR Agent
3. Click Uninstall
4. Enter the enrollment token when prompted

Silent Uninstall

# Uninstall via MSI
msiexec /x tamandua-agent.msi /qn

# Or via agent binary (token is prompted without echo)
& "C:\Program Files\Tamandua\tamandua-agent.exe" uninstall

Note: Uninstallation requires the original enrollment token for security. Contact your administrator if you do not have the token.

Next Steps

• Configure the Agent - Customize agent settings
• Enrollment Guide - Manage agent enrollment
• Linux Installation - Install on Linux systems
• macOS Installation - Install on macOS systems