Agent install & enrollment
Not every device is in Intune. The Patch Console agent is a lightweight PowerShell agent that keeps software inventory current on every Windows device and executes signed deployments on the devices Intune cannot reach.
What the agent is
The agent is PowerShell, installed by a signed MSI, and driven entirely by Windows scheduled tasks: there is no resident process or service consuming memory between runs. It wakes, does its work, reports, and exits.
Install and enrollment
One MSI serves the whole fleet. At install time the agent enrolls with a per-tenant enrollment token and receives its own device key, which is stored DPAPI-protected on the endpoint and scoped to that device. Upgrades install in place over the previous version.
What it inventories
Five collectors build the complete installed-software picture:
| Collector | What it finds |
|---|---|
| Registry (ARP) | Classic installed programs from the Add/Remove Programs registry, including per-user hives, so per-user installs are not invisible to a SYSTEM-context scan. |
| AppX / Store | Microsoft Store and other AppX-packaged applications. |
| winget | Packages known to Windows Package Manager, used to enrich matching and upgradability. |
| Filesystem / PATH | Portable and path-installed tools that never registered an installer. |
| Dev packages & extensions | Developer packages (npm, pip, NuGet) and installed browser extensions, feeding the OSV and extension-IOC lanes of the vulnerability engine. |
Reporting cadence
The agent reports on change: when the installed-software list differs from the last report, a new inventory goes up immediately. When nothing changes, a weekly heartbeat confirms the device is alive and its inventory is current. This is what lets verification close findings quickly instead of waiting for a scan window.
Script security
Deployment scripts for the agent channel are held to a strict chain of custody:
- Every script run is ECDSA-P256 signed by the server; the agent verifies the signature before executing anything.
- A hash allowlist means only known script content can run, even with a valid signature envelope.
- Deployments touching more than 25 devices require four-eyes approval: a second administrator must approve before the scripts ship.