Getting started

Before you begin

You need one 64-bit Windows Server (Server 2016+, or Windows 10/11) to act as the Controller — the machine PatchWalker installs on. The installer is self-contained, so there’s no separate runtime to install. Each machine you want to manage needs only:

• Windows targets: WinRM over HTTPS (port 5986) reachable from the Controller.
• Linux targets: SSH (port 22) reachable from the Controller, with an account PatchWalker can use.

A Domain / gMSA install lets the Controller manage domain machines with its Kerberos identity; a Standalone install uses certificate-based WinRM and works in workgroups.

1. Install the Controller

1. Download PatchWalker and verify its SHA-256.
2. Run the installer on your chosen Controller and follow the prompts. Choose Standalone or Domain / gMSA when asked.
3. When it finishes, open the PatchWalker console from the desktop shortcut (it points at the Controller’s address).

2. First-run setup

On first launch you’ll create the break-glass administrator — the always-available local admin account. Keep its password safe; it can’t be recovered if lost. From there you can add more users and roles, and optionally enable Microsoft Entra sign-in, under Admin → Authentication.

3. Enrol a Windows machine

1. Go to Admin → Enrolment and choose the Windows platform.
2. Download the enrolment launcher (or copy the command) and run it on the target as an administrator. It configures the WinRM HTTPS listener and registers the machine with the Controller.
3. The machine appears under Machines. Use Test Connection to confirm, then check for updates.

4. Enrol a Linux machine

1. On the Enrolment page choose Linux and copy the one-line command.
2. Run it on the target over SSH; it registers the machine with the Controller.
3. Assign an SSH credential under Admin → Credentials if needed, then test the connection.

5. Next steps

• Group machines and set up install schedules with maintenance windows.
• Configure email (SMTP) for notifications and scheduled compliance reports.
• Set up encrypted backups under Admin → Backup.
• For offline Ubuntu estates, enable the package mirror and contracts proxy.