IT SentinelOpen the console

Sentinel Global

Put IT Sentinel on this laptop

Pick your branch, copy one command, paste it into Windows PowerShell. About ten minutes, most of it downloads. You do not need an account here to do it.

Step 1: Which branch is this laptop?

This is the branch the machine reports into. Pick the wrong one and it turns up in somebody else's fleet — re-run the installer to change it.

Branch this laptop belongs to

Step 2: Run this in Windows PowerShell

Pick a branch above and it gets filled in for you. Paste it as-is and the installer shows a numbered menu instead.

& ([scriptblock]::Create((irm https://it-sentinel-control-plane.onrender.com/v1/enroll/bootstrap.ps1))) -ControlPlaneUrl https://it-sentinel-control-plane.onrender.com

It asks for administrator once, and changes nothing until you type INSTALL at the prompt. Want to know exactly what you are agreeing to first? Read what it installs, or open the installer itself.

Step 3: Check it worked

Three things should be true within a minute of the installer finishing.

  • The console prints SETUP COMPLETE with your branch name and the hub URL. If it prints SETUP INCOMPLETE instead, it lists exactly which checks failed and it is safe to run again.
  • A TightVNC tray icon appears in the notification area. Remote desktop is not silent — that icon is there the whole time the server is running.
  • The machine appears in the Command Center under your branch, with a healthy status dot. Heartbeats go out every 15 seconds, so it should not take long.

If it did not turn up

Run the preflight check on the laptop. It is read-only, it changes nothing, and it names the thing that is wrong — nearly always a hub URL that does not match or a branch slug the installer rejected.

& "$env:USERPROFILE\it-sentinel\scripts\preflight.ps1"

What this installs, and what it can do

The short version. The installer prints the full disclosure on screen before it touches anything and that one is authoritative — read it there, above the INSTALL prompt.

It installs

  • Node.js LTS, PowerShell 7, Git and pnpm — what the agent runs on
  • Google Chrome
  • TightVNC Server, for remote desktop
  • A startup entry, so the agent runs when you sign in

Anything already on the machine is left alone.

It changes

  • One inbound firewall rule, TCP 5900. Any machine on the network this laptop is joined to can then reach its remote-desktop port — on venue Wi-Fi, that is everyone in the room
  • Sets the TightVNC service to start automatically
  • Writes the hub URL and branch slug to a local .env, keeping the previous one as .env.bak

It sends, every 15 seconds

Hostname, LAN IP, MAC, serial and model. CPU, memory and the top processes by memory. Disk space and SMART health. Windows version, uptime and pending updates. Network reachability and this machine's public IP. Antivirus and firewall state. Printers, installed applications and monitored services. Recent critical and error entries from the event log, including their message text. Who is signed in, and whether the session is active, locked or idle.

It does not send

Email message contents — the heartbeat contract has no field for them. It does not log keystrokes, read your files, or capture the screen on a timer. The TightVNC password is typed by whoever is at the keyboard and never travels through this page.

Important: An operator can watch and control this desktop

Once TightVNC is running, an operator in the Command Center can view the screen, take over the mouse and keyboard, and dispatch commands that run on the machine. Every session and every command is written to the audit log with that operator's name against it, and the tray icon is visible throughout — but assume somebody can watch this screen.

This is a work-machine tool. Sign out of anything personal first, and do not enroll a laptop you would not want an operator to see.

Changed your mind?

Run the uninstaller below. It removes the agent, the startup entry, the firewall rule and TightVNC. The applications stay — they are yours to keep or remove.

The scripts themselves

Served by the control plane, so they always match the deployed version rather than whatever is on main. Read any of them before you run it — that is why they are here, and they are all in the public repository too.

On a network that blocks github.com? The bootstrap script falls back to /v1/enroll/repo.zip on this hub automatically, so the same command still works. And if the first request hangs for the better part of a minute, that is the free-tier host waking from idle, not a failure.