Install cnspec on Windows

Quick start

To install cnspec using PowerShell:

iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo

To also register cnspec with Mondoo Platform during installation:

$MONDOO_REGISTRATION_TOKEN="<your token from console.mondoo.com>"
iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo -RegistrationToken $MONDOO_REGISTRATION_TOKEN

For manual MSI installation or troubleshooting, read on.

Prerequisites

Before you integrate Microsoft Windows with Mondoo:

• Confirm access to the internet using PowerShell or CMD Terminal
• Confirm access to Mondoo systems using PowerShell or CMD Terminal
• Synchronize your system clock

Access to the internet using PowerShell or CMD Terminal

# from PowerShell
Test-NetConnection mondoo.com -Port 443

# from CMD terminal (activate telnet client if not already activated)
Telnet google.com 443

If you have a proxy setting in your environment, you might need to configure it in the PowerShell and CMD Terminal:

netsh winhttp show proxy

Systems access

Be sure you have access to these systems from PowerShell or CMD Terminal:

install.mondoo.com                   Port 443/https
releases.mondoo.com                  Port 443/https
eu.api.mondoo.com                    Port 443/https
us.api.mondoo.com                    Port 443/https
registry.api.mondoo.com              Port 443/https

To check connectivity, follow the approach in the previous section.

System clock sync

Make sure your system clock is in sync with your NTP or internet time:

w32tm /query /status
w32tm /query /peers
w32tm /resync

Install cnspec on Windows

Pick one of the install methods below.

Option A: Install using the automated install script in PowerShell

Make sure TLS 1.2 is enabled (it's enabled by default in modern Windows systems):

# To check
[Net.ServicePointManager]::SecurityProtocol

# If it is not enabled, enable it:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install cnspec by downloading a PowerShell script to memory and running it:

If you want the scan to use policies configured in your Mondoo Console space, you need to register using a registration token, which you receive during integration from https://console.mondoo.com/.

Without RegistrationToken set, the policies will be automatically loaded from our registry of open source policies.

# $MONDOO_REGISTRATION_TOKEN="YOUR_TOKEN_HERE"
iex ((New-Object System.Net.WebClient).DownloadString('https://install.mondoo.com/ps1'))
Install-Mondoo # -RegistrationToken $MONDOO_REGISTRATION_TOKEN

The installation creates one or two directories:

• The C:\Program Files\Mondoo directory contains binaries.
• The C:\ProgramData\Mondoo directory is only created if the registration token is used. It contains the mondoo.yml configuration file.

Option B: Install manually (Mondoo package including cnspec)

1. Download the Mondoo Windows installer.

2. Execute the installer as administrator.

   Example:

   # PowerShell
   Start-Process -Wait msiexec -ArgumentList ' /i  mondoo_13.0.0_windows_amd64.msi'
   
   # CMD Terminal
   start /wait msiexec /i mondoo_13.0.0_windows_amd64.msi

3. Follow the steps and agree to the license agreement.

4. (Optional) Register cnspec with your Mondoo Platform account.

   If you enter a registration token during the installation wizard, cnspec registers automatically.

   You can also register by token later if needed:

   start /wait msiexec /i mondoo_13.0.0_windows_amd64.msi  REGISTRATIONTOKEN="XXXXXXXXXXXXXXXXX"

Option C: Install with Chocolatey

If you manage Windows software with Chocolatey, install the mondoo package from an elevated PowerShell or CMD prompt:

choco install mondoo -y

To register cnspec with Mondoo Platform after the install completes, run cnspec login with a registration token (read Register cnspec for details):

cnspec login --token "YOUR_REGISTRATION_TOKEN"

To upgrade later:

choco upgrade mondoo -y

Verify the install

Confirm cnspec is registered and can reach Mondoo Platform:

cnspec status

If cnspec is registered, the output includes loaded configuration from C:\ProgramData\Mondoo\mondoo.yml. For other outcomes, see Validate registration.

Run a one-off scan against the local host:

cnspec scan local

cnspec uses the policies enabled for the registered space. To scan with Mondoo's open source policies instead:

cnspec scan local --incognito

Run cnspec as a service

The Windows installer registers mondoo with the Service Control Manager but leaves it set to Manual startup. To enable it so cnspec scans on a recurring schedule and reports back to Mondoo Platform, follow Run cnspec as a service and use the Windows tab.

Proxy configuration

cnspec also works behind a forward proxy, such as Squid.

$env:https_proxy = "<ip-address>:<port>"

To set the proxy configuration for cnspec permanently, add the proxy configuration during cnspec registration:

cnspec login --token 'YOUR_TOKEN_HERE' --api-proxy 'http://1.1.1.1' --config 'C:\ProgramData\Mondoo\mondoo.yml'

Or add it to the cnspec configuration directly. Follow these steps:

1. Navigate to the cnspec configuration file under C:\ProgramData\Mondoo\mondoo.yml
2. Add this line:

api_proxy: http://1.1.1.1

Learn more

• Register cnspec
• Run cnspec as a service
• Update cnspec
• Uninstall cnspec