Deploy on Windows

Windows support depends on the qualified Windows and OpenSSH release listed for your Tenvyr build. Complete a lab qualification before using Intune, Configuration Manager, or Group Policy for broad deployment.

Prerequisites

• Windows OpenSSH Server is installed and running.
• PowerShell can validate the effective sshd_config.
• The host can reach agents.tenvyr.com over HTTPS.
• The service account can protect the agent's private state.
• A separate administrative recovery path has been tested.

Deployment sequence

1. Distribute the signed installer without an enrollment secret.
2. Install the Windows service but keep it stopped.
3. Issue a unique token for the host's intended Tenvyr host group.
4. Transfer it through a device-specific protected workflow.
5. Run one-time enrollment from an elevated process.
6. delete the transferred secret material;
7. start the service; and
8. confirm heartbeat, host keys, desired-state validation, and SSH access.

Use the paths and service name from the signed Windows package. Do not translate Linux paths literally.

Enterprise deployment checks

Test interactions with:

• Defender and endpoint detection controls;
• application allowlisting;
• OpenSSH configuration file ACLs;
• LocalSystem or the designated service identity;
• Windows update and OpenSSH servicing;
• domain Group Policy; and
• configuration drift tooling.

If another system owns the same OpenSSH settings, establish one source of truth before production rollout.