Skip to main content

Installing the Windows Sensor

The Windows Endpoint Sensor can be deployed to your endpoint devices using any of the following methods.

  • Manual Installation
  • Microsoft Configuration Manager
  • Microsoft Intune
  • JumpCloud
  • Manage Engine

The windows sensor can also be installed in virtualised or VDI environments but requires some specific consideration to ensure performance review VM & VDI Installation.

Prerequisites​

When you install the Endpoint Sensor, Cyberhaven's browser extensions are automatically installed. If you prefer to manage the installation and updates to the browser extensions independently, outside of Cyberhaven’s management, then contact Cyberhaven Support and request that the Sensor’s configuration settings be customized to suit your requirements. Without this customization, the Sensor will override any manual changes that were applied to Cyberhaven’s browser extension policies.

Windows Sensors are designed to run on Windows endpoint devices to monitor data movements in your environment and prevent data leaks.

Operating System and Hardware Requirements​

When installing the Cyberhaven Windows sensor on systems that would support a single logged in user at any time the following specifications are required.

  • Dual-core 64-bit Intel CPU or ARM64-based CPU (using ARM64-specific installer)

    Note: ARM64 sensor installer is available upon request. Contact Customer Support to request the installer.

  • Minimum 4 GB of RAM

  • Minimum 300MB GPU RAM

  • Minimum 5 GB of free disk space

ARM64 Limitations​

ARM64-based installations have the following known limitations:

  • User actions related to printing are not tracked

  • The local databases, which store policy and dataset definitions, offline events, and data at rest scanning results do not support encryption yet. Support for database encryption on ARM will be added in a future release.

Supported Windows Releases and Versions​

Windows versionSupported Releases
Windows 101809+
Windows 11All versions
Windows Server1809+

Dependencies​

3rd Party Software​

The Windows Sensor requires the following applications. Before installing the Windows Sensor, ensure that these applications are installed.

  • Visual Studio 2010 Tools for Office Runtime — this is not needed if you have Microsoft Outlook and/or Microsoft Office installed. Check out this guide on how to deploy this runtime with SCCM.

  • Microsoft .NET Framework 4.6.2 — Cyberhaven requires at least version 4.6.2. The .NET Framework is built into all supported Windows versions unless it was explicitly removed.

  • Latest Microsoft Visual C++ redistributable — Cyberhaven utilizes certain Visual C++ libraries. Check the link to get the latest version of Visual C++ redistributable.

Network​

The sensor must be able to resolve the backend URL and connect to the Cyberhaven service over TCP port 443.

Security exclusions​

Make sure to exclude all Windows Sensor-related files, folders, and processes from being scanned, monitored, or blocked by any security applications or tools. Review the full list of Sensor processes and paths, Windows Sensor Processes and Paths.

VDI Support​

The Windows Sensor can start monitoring user activities immediately after they are connected to a VDI session. Irrespective of the sequence in which users log into their sessions, the Sensor can trace and block actions that match your predefined policies. When a user disconnects from a session, their Sensor slot is made available for the next active user which ensures continuous monitoring across all sessions.

VDI Requirements​

When deploying the Cyberhaven Windows sensor on systems that will support multiple logged in users at a time the following are the minimum specifications required.

  • Quad-core 64-bit CPU
  • Minimum 8 GB of RAM
  • Minimum 5 GB of free disk space

To install the Sensor in a non-persistent VDI environment, see VM & VDI Installation

VDI Limitations​

The increased coverage for VDI sessions has an impact on the resource utilization of the sensor (CPU, Memory, and I/O). To limit this impact the recommended limit for maximum consecutive sessions is between 15 and 30 depending on the levels of activity.

During periods of heavy Input/Output activity, there may be a noticeable decrease in the performance of the Sensor. The process quotas set for the Sensor are not automatically adjustable. They must be manually adjusted in the backend to ensure that the Sensor does not run out of memory and terminate unexpectedly. Contact Cyberhaven Support to adjust the process quotas.