The Windows agent is a single executable, IdolbePatchAgent.exe, that runs as a Windows service under the SYSTEM account. It inventories the computer, detects missing updates and vulnerabilities, and executes the actions you queue in the console.

Requirements

Install on one computer

1. In the console open Endpoints → Install Agent and click Download .MSI. The downloaded IdolbePatchAgent.msi is unique to your organization: the enrollment key and the console's address are embedded in it, so there is nothing to type.
2. Run the file on the computer, check the two values the setup shows, click Install and approve the Windows security prompt.
3. The setup installs the agent in C:\Program Files\IdolbePatch\, enrolls the computer, installs the IdolbePatchAgent service and starts it.
4. Back in the console, Getting started shows Agent installed and the computer appears under Endpoints within a minute.

Running the same file again on an already-managed computer upgrades the agent in place and keeps its identity; it never creates a duplicate endpoint.

The self-installing IdolbePatchAgent.exe does the same with a double-click: Other Options → Self-installing EXE. (A console whose MSI predates the embedded values offers the exe as its main button instead.)

Windows executables and the MSI are Authenticode-signed (publisher: IT HELP SERVICES). Windows SmartScreen may still show "Windows protected your PC" on the first installations while the certificate builds its reputation: click "More info" then "Run anyway", or deploy silently as described below, which shows no prompt. Every release is also signed with an Ed25519 key that the agent verifies before any self-update.

Silent install (Group Policy, Intune, SCCM, RMM)

Getting started → Other options shows these commands with your key filled in. Run them elevated (SYSTEM or an administrator):

# Enroll, then install the service (no user interaction)
IdolbePatchAgent.exe -register -enrollmentkey "<your enrollment key>" -serverurl "<console URL>"
IdolbePatchAgent.exe -install

The agent reports to the console it was given: -serverurl, or the console that served the download. The console writes its address and the organization key into the agent's signature, so the downloaded IdolbePatchAgent.exe can be renamed or copied freely; the signature stays valid. (Consoles serving an agent older than 0.12.41 name the download IdolbePatchAgent_<key>@<console host>.exe instead: keep that file name.)

MSI package for Group Policy software installation, Intune line-of-business or Win32 apps, SCCM: the IdolbePatchAgent.msi downloaded from the console carries the key and the console in its signature, like the exe, so it needs no property:

msiexec /i IdolbePatchAgent.msi /qn
msiexec /x IdolbePatchAgent.msi /qn

The file can be renamed or copied to a share; the signature stays valid. Properties given on the command line win over the embedded values (ENROLLMENTKEY="<key>" SERVERURL="<console URL>"): use them to point one package at another organization. An MSI without embedded values (published by a console before this change) needs both properties, or asks for them when double-clicked.

The MSI installs the same executable, enrolls the computer and registers the service as SYSTEM. Installing a newer MSI upgrades in place and keeps the endpoint's identity; /x tells the console and removes the service. Intune detection rule: the service IdolbePatchAgent exists.

Download and install in one step from a startup script or an RMM tool:

Invoke-WebRequest "<console URL>/api/agents/download?key=<your enrollment key>" -OutFile "$env:TEMP\IdolbePatchAgent.exe"
& "$env:TEMP\IdolbePatchAgent.exe" -register -enrollmentkey "<your enrollment key>" -serverurl "<console URL>"
& "$env:TEMP\IdolbePatchAgent.exe" -install

The enrollment key identifies your organization, not a computer. Treat it like a password: anyone who has it can enroll computers into your organization. Rotate it from Organizations → Rotate key if it leaks; agents already enrolled keep working (they hold their own per-endpoint token).

Active Directory Deployer

Agent Deployment turns one enrolled domain computer into a deployer: it scans Active Directory for computers without the agent and installs it remotely with the domain credentials you provide. The credentials are stored encrypted in the console and handed to the deployer once per scan; they never appear in the queued command. See the page itself for prerequisites (admin shares, WinRM or SMB reachability).

What the agent does

• Check-in every hour: hardware, operating system, logged-on user, network, disks, installed software (machine and per-user, including Microsoft Store and winget applications), antivirus, BitLocker, pending reboot, Windows Update settings.
• Missing updates: Windows Update including the Microsoft Update service (Office MSI editions, .NET, SQL Server, drivers), Windows feature updates (version upgrades such as 23H2 → 24H2, shown as "Feature Updates" when Windows Update offers them to the device), Microsoft 365 Apps click-to-run builds compared with the latest build of the device's update channel, and third-party applications through winget in the user's session plus the version catalog. Drivers are hidden by the default "All except Drivers" filter but are available.
• Vulnerabilities: the console correlates the inventory with NVD, CISA KEV and Microsoft advisories; nothing is scanned on the computer itself.
• Commands every 30 seconds: Run Script (PowerShell or CMD, as SYSTEM), Deploy Updates (Windows Update, feature updates, Microsoft 365 Apps through the Office click-to-run client, winget), Deploy Software (MSI, EXE, MSIX, winget), Uninstall Software, Reboot with the branded end-user prompt, data source collections.
• Self-update: when the console publishes a newer agent, the agent downloads it at its next check-in, verifies the signature and restarts itself. Agent Auto-Update can be turned off under Advanced → Endpoints.

Command output is capped at 4 MB and every command has a timeout (per action type, or the timeout you set in the payload); a runaway script is killed together with its child processes.

Files, logs and permissions

The agent hardens these permissions at every start.

Uninstall

From an elevated prompt:

"C:\Program Files\IdolbePatch\IdolbePatchAgent.exe" -uninstall

The agent tells the console first (the endpoint disappears immediately instead of lingering as disconnected), stops and deletes the service, then removes its configuration, logs and program files. When an organization is closed from Subscription → Close Account, every online agent receives this order automatically (Data retention and account closure).

Deleting an endpoint from the console (Endpoints → Delete, or the API) also removes the agent: at its next check-in the console answers that the endpoint was revoked and the agent uninstalls itself (agents 0.11.4 and later; older agents stop with an error in their log). Running the download again on that computer enrolls it deliberately and lifts the revocation.

Moving a computer to another organization

Uninstall the agent, then run the download of the new organization. The agent refuses to switch organizations silently: an enrolled computer only ever re-enrolls into the organization whose key it holds.