Install cnspec on Windows

Quick startCopy Anchor Link

To install cnspec using PowerShell:

iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo

To also register cnspec with Mondoo Platform during installation:

$MONDOO_REGISTRATION_TOKEN="<your token from app.mondoo.com>"
iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo -RegistrationToken $MONDOO_REGISTRATION_TOKEN

For manual MSI installation or troubleshooting, read on.

PrerequisitesCopy Anchor Link

Before you integrate Microsoft Windows with Mondoo:

• Confirm access to the internet using PowerShell or CMD Terminal
• Confirm access to Mondoo systems using PowerShell or CMD Terminal
• Synchronize your system clock

Access to the internet using PowerShell or CMD TerminalCopy Anchor Link

# from PowerShell
Test-NetConnection mondoo.com -Port 443

# from CMD terminal (activate telnet client if not already activated)
Telnet google.com 443

If you have a proxy setting in your environment, you might need to configure it in the PowerShell and CMD Terminal:

netsh winhttp show proxy

Systems accessCopy Anchor Link

Be sure you have access to these systems from PowerShell or CMD Terminal:

install.mondoo.com                   Port 443/https
releases.mondoo.com                  Port 443/https
eu.api.mondoo.com                    Port 443/https
us.api.mondoo.com                    Port 443/https
ingest.eu.mondoo.com                 Port 443/https
ingest.us.mondoo.com                 Port 443/https
registry.api.mondoo.com              Port 443/https

The ingest host for your region receives scan results, so allow it alongside the API host.

To check connectivity, follow the approach in the previous section.

System clock syncCopy Anchor Link

Make sure your system clock is in sync with your NTP or internet time:

w32tm /query /status
w32tm /query /peers
w32tm /resync

Install cnspec on WindowsCopy Anchor Link

Pick one of the install methods below.

Option A: Install using the automated install script in PowerShellCopy Anchor Link

Make sure TLS 1.2 is enabled (it's enabled by default in modern Windows systems):

# To check
[Net.ServicePointManager]::SecurityProtocol

# If it is not enabled, enable it:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install cnspec by downloading a PowerShell script to memory and running it:

If you want the scan to use policies configured in your Mondoo App space, you need to register using a registration token, which you receive during integration from https://app.mondoo.com/.

Without RegistrationToken set, the policies will be automatically loaded from our registry of open source policies.

# $MONDOO_REGISTRATION_TOKEN="YOUR_TOKEN_HERE"
iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo # -RegistrationToken $MONDOO_REGISTRATION_TOKEN

The installation creates one or two directories:

• The C:\Program Files\Mondoo directory contains binaries.
• The C:\ProgramData\Mondoo directory is only created if the registration token is used. It contains the mondoo.yml configuration file.

Option B: Install manually (Mondoo package including cnspec)Copy Anchor Link

1. Download the Mondoo Windows installer.

2. Execute the installer as administrator.

   Example:

   Copy Text

   # PowerShell
   Start-Process -Wait msiexec -ArgumentList ' /i  mondoo_14.0.1_windows_amd64.msi'
   
   # CMD Terminal
   start /wait msiexec /i mondoo_14.0.1_windows_amd64.msi

3. Follow the steps and agree to the license agreement.

4. (Optional) Register cnspec with your Mondoo Platform account.

   If you enter a registration token during the installation wizard, cnspec registers automatically.

   You can also register by token later if needed:

   Copy Text

   start /wait msiexec /i mondoo_14.0.1_windows_amd64.msi  REGISTRATIONTOKEN="XXXXXXXXXXXXXXXXX"

Option C: Install with ChocolateyCopy Anchor Link

If you manage Windows software with Chocolatey, install the mondoo package from an elevated PowerShell or CMD prompt:

choco install mondoo -y

To register cnspec with Mondoo Platform after the install completes, run cnspec login with a registration token (read Register cnspec for details):

cnspec login --token "YOUR_REGISTRATION_TOKEN"

To upgrade later:

choco upgrade mondoo -y

Verify the installCopy Anchor Link

Confirm cnspec is registered and can reach Mondoo Platform:

cnspec status

If cnspec is registered, the output includes loaded configuration from C:\ProgramData\Mondoo\mondoo.yml. For other outcomes, see Validate registration.

Run a one-off scan against the local host:

cnspec scan local

cnspec uses the policies enabled for the registered space. To scan with Mondoo's open source policies instead:

cnspec scan local --incognito

For a guided walkthrough of running a scan and reading the results, see the Quickstart.

Run cnspec as a serviceCopy Anchor Link

The Windows installer registers mondoo with the Service Control Manager but leaves it set to Manual startup. To enable it so cnspec scans on a recurring schedule and reports back to Mondoo Platform, follow Run cnspec as a service and use the Windows tab.

Proxy configurationCopy Anchor Link

Starting with cnspec 14, a Windows host that already sends its traffic through a proxy needs no extra configuration. cnspec reads the proxy from Internet Settings, from a setup script, or from the WinHTTP default proxy that netsh winhttp set proxy sets, checks that the proxy carries its traffic, and uses it for the CLI and for the service. A proxy that fails that check is left alone and cnspec connects directly, as earlier versions did. Read Proxy configuration for the details and for the order in which cnspec considers each source.

To send Mondoo Platform traffic through a specific proxy instead, set it during registration:

cnspec login --token 'YOUR_TOKEN_HERE' --api-proxy 'http://1.1.1.1:8080' --config 'C:\ProgramData\Mondoo\mondoo.yml'

Or add it to the configuration file C:\ProgramData\Mondoo\mondoo.yml:

api_proxy: http://1.1.1.1:8080

A proxy in the configuration file overrides the HTTPS_PROXY environment variable and the Windows proxy settings. To make cnspec ignore the Windows proxy settings altogether, add system_proxy: false to the same file.

Learn moreCopy Anchor Link

• Register cnspec
• Run cnspec as a service
• Update cnspec
• Uninstall cnspec