Windows
On Windows, install the agent with the one-line PowerShell command from the dashboard's Install Agent page (see Agent Installation). The installer downloads the binary, enrolls the endpoint, writes its configuration and certificates, and registers the agent so it starts automatically.
How it registers depends on whether PowerShell runs as Administrator (system-wide) or as a regular user:
| System install (Administrator) | User install | |
|---|---|---|
| Registration | Windows Service sielum-agent | Task Scheduler task sielum-agent (At Logon) |
| Binary | C:\Program Files\sielum\sielum-agent.exe | %LOCALAPPDATA%\sielum\sielum-agent.exe |
| Certificates & config | C:\ProgramData\Sielum | %APPDATA%\Sielum |
| Firewall enforcement | ✅ (Windows Filtering Platform) | ❌ (monitoring only) |
If you run the installer without Administrator and without -UserMode, it offers to elevate via UAC (full system install) or fall back to user-mode; non-interactive sessions default to user-mode.
This page covers Windows-specific service management and removal.
Managing the service
# System install — Windows Service
Get-Service sielum-agent
Stop-Service sielum-agent
Start-Service sielum-agent
# Event-log diagnostics for the service
Get-EventLog -LogName Application -Source sielum-agent -Newest 50
# User install — Task Scheduler task
schtasks /Query /TN "sielum-agent" /FO LIST
schtasks /End /TN "sielum-agent" # stop
Start-ScheduledTask -TaskName "sielum-agent"
The endpoint appears in Dashboard → Devices on the agent's first check-in. The agent sends its first report right after startup, then checks in on its regular interval (default 5 minutes, see Agent Configuration).
A system service and a user-mode task running at the same time will report duplicate data. The installer warns when it detects both — remove the one you don't want before continuing.
Privileged vs. user mode
A system install (Administrator) runs as a Windows Service in privileged mode, which enables firewall enforcement through the Windows Filtering Platform (WFP) for both IPv4 and IPv6. A user-mode install runs as a Task Scheduler task (monitoring only, no elevation). See Agent Installation for the feature comparison.
Uninstall
The installer ships an uninstall script that detects both install modes and removes the service or task, binary, certificates, and any firewall rules:
# Run from an elevated (Administrator) PowerShell to also remove the system service
irm https://app.sielum.io/api/install/uninstall.ps1 | iex
Useful parameters when running the downloaded script (.\uninstall.ps1): -DryRun shows what would be removed without touching anything, -Yes skips the confirmation prompt, and -Mode system / -Mode user restricts the scope to a single install. Removing the system service and its firewall rules requires Administrator.
To remove things by hand instead:
# System install — Windows Service
Stop-Service sielum-agent
sc.exe delete sielum-agent
Remove-NetFirewallRule -Name "sielum-Block-*"
Remove-Item -Recurse -Force "C:\Program Files\sielum"
Remove-Item -Recurse -Force "C:\ProgramData\Sielum"
# User install — Task Scheduler task
Unregister-ScheduledTask -TaskName "sielum-agent" -Confirm:$false
Remove-Item -Recurse -Force "$env:LOCALAPPDATA\sielum"
Remove-Item -Recurse -Force "$env:APPDATA\Sielum"
The agent remains visible in the dashboard as offline after a local uninstall. Revoke its registration from Dashboard → Devices if you do not intend to re-enroll the same machine.