Windows Agent - install and setup¶

The CertIntel Agent is a local certificate lifecycle service. It can:

• issue and renew certificates with its embedded ACME client, following the CA's renewal window (ARI) when it offers one;
• answer CertIntel Delegated DNS-01 challenges;
• store certificates in Windows stores or protected files;
• update IIS bindings, reload supported web servers, run an approved local installation program, or restart a selected Windows service;
• bind certificates to Microsoft server roles such as Exchange, Remote Desktop, RRAS, SQL Server, AD FS, NPS and WinRM (Microsoft services, Agent 1.5.0 and later);
• deploy certificates to F5 BIG-IP, FortiGate, PAN-OS, NetScaler ADC and SonicWall appliances over their management API (Remote & appliance deployment, Agent 1.5.0 and later);
• inventory local TLS endpoints, certificate files and Windows certificate stores; and
• scan internal endpoints assigned to it by CertIntel.

This page covers the Agent up to 1.8.0; notes such as Agent 1.3.93 and later or Agent 1.8.0 and later mark behaviour that earlier releases lack. The service owns configuration, credentials, ACME state and private keys. The desktop app runs without administrator privileges and asks Windows for approval the first time you change something (see Administrator approval). Privileged work runs in the LocalSystem service and its separate deployment worker. CertIntel has no remote shell or general remote-command channel into the machine.

Requirements¶

• Windows x64 and a local administrator account for installation and for using the desktop app. A standard user sees An administrator account is required and a Restart as administrator button.
• .NET 10 Desktop Runtime (x64) for the desktop app and the deployment worker. The MSI checks for a 10.0.x Desktop Runtime and stops with a message pointing to the download page if it is missing. The online installer downloads and verifies it for you.
• Outbound HTTPS to your CertIntel API, the selected ACME certificate authority, the signed release endpoints if automatic updates are enabled, and the management interface of any appliance a workflow deploys to (Agent 1.5.0 and later).
• Working DNS resolution. DNS-01 propagation checks may query authoritative, public and machine-configured resolvers.
• No inbound port. ACME names are validated with Delegated DNS-01; HTTP-01 was removed in Agent 1.5.0.
• Java keytool.exe only when creating or monitoring a Java keystore.

The service is named CertIntelAgent and runs as LocalSystem. The installation paths are fixed; the MSI does not support relocating them.

Routine activity is retained in the agent's own journal and shown on Activity. Only errors are copied to the Windows Application event log, including a CertIntelAgent service failed: ... event if the service cannot start.

Recommended installation¶

On the dashboard's Install Tokens page, click Install on Windows on your organization's token row (platform builds after 2026.10.28; earlier builds have only Show, which opens the same page). The token page that opens, at its Install on Windows section, generates a one-line command that downloads the CertIntel bootstrap from https://certin.tel/install.ps1; the list page itself shows only the token's prefix and no command. Installing a single machine by hand? Mint a one-time install token from the same page or the Agents page instead (platform builds after 2026.10.28): it is shown once with these same commands, enrolls exactly one agent and expires on its own; see Install tokens & enrollment. The bootstrap:

1. reads the current release record from two independent sources (assets.certin.tel and api.certin.tel) and refuses to continue if they disagree or the record has expired;
2. downloads the versioned, Authenticode-signed installer script install-windows.ps1 and checks its SHA-256 and signer thumbprint;
3. runs that installer, which downloads the matching MSI, checks its size, SHA-256, signature and MSI identity, installs the .NET 10 Desktop Runtime if needed, installs the MSI, and connects the agent with your token.

Open PowerShell as administrator and run the generated command. It looks like this:

$env:CI_INSTALL_TOKEN = "cit_..."
& ([scriptblock]::Create((irm https://certin.tel/install.ps1)))

The Installation options on that token page change what is appended to that command:

An invalid setting value fails the MSI's launch conditions before anything is installed: a silent run ends with exit code 1603 and the installer log names the option.

A cmd.exe / RMM one-liner is also offered for deployment tools:

set CI_INSTALL_TOKEN=cit_...
powershell -NoProfile -ExecutionPolicy Bypass -Command "& ([scriptblock]::Create((irm https://certin.tel/install.ps1)))"

The bootstrap also accepts these environment variables instead of switches: CI_API_BASE, CI_API_KEY (a cik_ agent key, to reconnect an existing device instead of enrolling a new one), CI_NONINTERACTIVE=1, CI_RESET_EXISTING_DATA=1, CI_TRUST_CODE_SIGNING_CERT=1 and, for the agent settings above, CI_INSTALL_OPTIONS="NAME=VALUE NAME=VALUE" (space-separated, Agent 1.8.0 and later; the Linux bootstrap uses CI_AGENT_SETTINGS and --agent-setting key=value instead, applied with certintel config set after installation). Supply a token or an agent key, never both. An ordinary integration key is not a substitute for enrolling an Agent.

Use a real cit_ token with no added label, quotes, spaces, or newline inside the value. Input is passed exactly; malformed or altered credentials are not silently repaired. The installer clears the token from its environment before launching child processes. Clear it in your own shell afterwards and never save a populated command in tickets, logs or source control.

What you will see¶

• Resolving the current CertIntel Agent release and Downloading and verifying the installer, then the installer's own steps: checking the authorized release, installing .NET if needed, downloading and verifying the Agent, installing, and Connecting this computer to CertIntel.
• On an interactive run with an existing installation: An existing CertIntel Agent installation or saved data was found. Choose K to keep the connection, workflows, certificates, configuration and logs (default) or R to remove everything and start over. Removal requires typing REMOVE.
• A failure prints CertIntel Agent installation failed during '<step>': .... Existing protected agent data is retained.

After install-token enrollment, the device is pending approval; reporting stays rejected until an administrator approves it on the CertIntel Agents page. See Install tokens & enrollment.

Verifying the scripts yourself¶

The bootstrap does the download and signature checks for you. If your policy requires reviewing scripts before execution, download install-windows.ps1 from the versioned release directory listed in the release record, compare its SHA-256 with the record's installWindowsSha256 value, and inspect its signature:

Get-AuthenticodeSignature -FilePath .\install-windows.ps1 | Format-List Status, StatusMessage
(Get-AuthenticodeSignature -FilePath .\install-windows.ps1).SignerCertificate.Thumbprint

The signing certificate is currently self-signed, so Status shows UnknownError with the message A certificate chain processed, but terminated in a root certificate which is not trusted unless you have trusted the certificate. That is the expected result. What matters is the thumbprint DD3F69F48412C05A9365E4863B7FFFBE254FE62D and an intact signature; confirm the thumbprint with your administrator or another trusted source. Stop on HashMismatch, NotSigned, a different signer, or any other error. Do not disable verification to get past a failure.

Then run the saved script directly in an elevated prompt. It takes the same -ApiBase, -InstallToken, -ApiKey, -NonInteractive and -ResetExistingData parameters; -TrustCodeSigningCertificate exists only on the bootstrap, so trust the signing certificate yourself if you need to. When you run the signed installer directly (not through the bootstrap), inherited CI_INSTALL_TOKEN / CI_API_KEY environment variables are used only with -NonInteractive and -AllowEnvironmentCredentials; otherwise it stops with Inherited environment credentials require an explicit automation opt-in. Interactive runs prompt for the token without echo.

MSI deployment¶

The MSI installs the binaries and service only. It does not accept connection credentials. Older guidance that passed INSTALLTOKEN, APIKEY or APIBASE to msiexec no longer works: Windows Installer ignores unknown properties, and the machine is left in setup required state until you connect it from Settings or the CLI.

Download the current MSI and its release record:

• certintel-agent_windows_amd64.msi
• info.json

Install interactively or silently:

msiexec.exe /i .\certintel-agent_windows_amd64.msi
msiexec.exe /i .\certintel-agent_windows_amd64.msi /qn /norestart

The public MSI properties are the install options below and REMOVEALLDATA. A fresh installation starts with the defaults in the table; an option that is not given keeps the default on a fresh installation and the saved setting on an upgrade. The same settings are changed later with certintel config set (certintel config set --help), in the desktop app or in the terminal interface. The PowerShell installers pass them through with -InstallOption NAME=VALUE (Agent 1.8.0 and later).

An invalid option value fails the launch conditions before anything is installed (exit code 1603 for a silent install; the log names the option).

msiexec.exe /i .\certintel-agent_windows_amd64.msi /qn /norestart AUTOUPDATEINSTALL=1 RENEWALCHECKINTERVALMINUTES=360 ASSIGNMENTAUTOAPPLY=0

After the MSI finishes it verifies that the installed version matches the package and that the service starts and answers within 60 seconds; otherwise Windows Installer rolls the installation back. A downgrade is refused with A newer CertIntel Agent version is already installed.

Then connect the machine:

• In the desktop app, open Settings → API / Server details and enter the install token or agent API key, or
• run certintel enroll --api-base https://api.certin.tel (install token) or certintel register --api-base ... (agent API key) in an elevated prompt. Both prompt for the secret without echo; add --stdin for automation. Secrets are never accepted as command-line arguments.

For a fully offline installation, the release also contains a signed install.ps1 wrapper that takes -MsiPath and a mandatory -ExpectedSha256 (from the release record), verifies the MSI's hash, signature and identity in a protected staging folder, installs it silently, and then connects the agent with the credential you pass or type.

Connect, reconnect or disconnect¶

In the desktop app, Settings → API / Server details accepts an install token or API key for a fresh setup. Once connected, the same section can replace a rotated API key or disconnect the machine. Changing the API origin of a connected host is refused until you disconnect first.

CLI equivalents, run elevated:

certintel enroll --api-base https://api.certin.tel
certintel register --api-base https://api.certin.tel
certintel unregister
certintel status --json
certintel diagnostics

Enrollment exchanges the token once for a machine credential, protects the credential locally, and discards the token. A saved local credential alone does not mean approval is complete; use Test connection and Activity to confirm. Test connection reports Approval required: Approve this agent in the CertIntel dashboard, then test the connection again. while the device is pending. Other requests the pending Agent makes on its own (the heartbeat, reports, the Private CA probe) are refused with HTTP status 428. Agent 1.3.93 and later record that once, as an approval-pending event (Waiting for administrator approval in the CertIntel dashboard (CertIntel HTTP 428 from ROUTE); Private CA, Internal TLS Probe - Cloud, AD CS and CRL cloud checks resume after approval), report approval_pending: true in certintel status --json, and log approval-granted (This agent was approved in the CertIntel dashboard; cloud checks resume and the Private CA availability is being checked) when they notice the approval. Agent 1.3.92 and earlier record every refused request verbatim as CertIntel HTTP 428 in Activity, certintel diagnostics output and job results, including a Cloud check failed: CertIntel HTTP 428 entry per scan. Either way it is the same condition, not a key or network fault: the platform is waiting for an administrator to click Approve on the Agents page.

Once approved, the service sends a short heartbeat to CertIntel at start, after a new or changed connection, and then about hourly (agents 1.3.62 and later). It carries only the computer name and the version, operating system and architecture already in the agent's request header, so a device with no monitors, no assigned checks and no certificate work still shows as online on the Agents page with its current version. A successful heartbeat updates the local Last check-in time; failures are retried without touching the report queue. Agent 1.3.93 and later also send one the moment they notice they were approved and then about every minute for 15 minutes, and every answer carries whether the key may request Private CA certificates and how many active CAs exist, so a permission granted shortly after approval is seen within about a minute (see Enabling it for an Agent).

Disconnecting removes the local platform credential and queued reports but retains certificate workflows, ACME keys, issued certificates and local monitor configuration. CertIntel marks the device unregistered locally; revoke or re-register it on the Agents page separately.

Command-line configuration¶

Everything the desktop app saves can also be changed from an elevated prompt with the Agent's versioned configuration transaction:

certintel --json config get                       # non-secret configuration, with its revision
certintel validate --file C:\certintel\config.json
certintel config apply --file C:\certintel\config.json
certintel workflows create --template ID --certificate-id ID --domains NAMES [...]   # Agent 1.3.93 and later
certintel lock --reason "Change freeze"           # Agent 1.4.0 and later: configuration lock
certintel lock status
certintel unlock
certintel config set renewal-check-interval-minutes=360 assignment-auto-apply=off   # Agent 1.8.0 and later

config set KEY=VALUE ... (Agent 1.8.0 and later) changes the settings that the install options set at installation, without the get-edit-apply cycle: update-check, update-auto-install, update-check-interval-hours, monitor-interval-hours, managed-checks, managed-check-interval-minutes, renewal-check-interval-minutes and assignment-auto-apply. Switches take on/off, true/false, yes/no or 1/0.

config get prints one line of JSON. Edit a copy, keep the revision it came with, validate, then apply; config apply refuses with conflict: configuration changed when the revision moved in the meantime. Secrets are never part of the file; set them with certintel secret set …. Agent 1.3.93 and later add workflows create, which builds a certificate and its workflow from a bundled template and applies both for you. See the workflow reference and the complete IIS + Private CA example.

$json | Out-File C:\certintel\config.json -Encoding ascii     # ASCII-only content
[IO.File]::WriteAllText('C:\certintel\config.json', $json, [Text.UTF8Encoding]::new($false))

Configuration lock¶

Agent 1.4.0 and later have a configuration lock: a file on the machine that only a local administrator can create or remove. While it exists, the Agent refuses configuration changes proposed by the CertIntel platform. The only such changes are dashboard-assigned workflows; the platform cannot push scripts, hooks or other configuration to an Agent at all. Use it on machines where nobody should be able to change the Agent's workflows from the dashboard, for example during a change freeze.

Turning it on or off

• Desktop app - Settings → Configuration lock: Turn on configuration lock… asks for an optional one-line reason (up to 200 characters) shown with the lock here, in the terminal interface and in the dashboard; Turn off configuration lock… asks for confirmation. Unless the app runs elevated, the CertIntel Agent - administrator approval dialog then confirms the change. While the lock is on, a Configuration lock on badge sits in the window header, and the dashboard assignments section disables Approve… and the auto-apply checkbox.
• Command line (elevated prompt) - certintel lock [--reason TEXT], certintel lock status and certintel unlock. They exit with 0 on success, 1 on an error and 2 when the prompt is not elevated. Without elevation the current state is still visible as config_lock in certintel status --json (locked, since, by, reason, error).

The file is %ProgramData%\CertIntelAgent\config.lock, readable and writable only by SYSTEM and Administrators, and holds {"schema":1,"locked_at":"…","locked_by":"…","reason":"…"}. The service reads it at most once a minute and tells CertIntel within about 30 seconds after noticing a change; the dashboard then shows the Agent as Locked. A file that is damaged or cannot be read counts as locked, with the error shown next to the state, so a broken lock never silently opens up.

Administrator approval in the desktop app¶

The app starts without elevation. Everything is readable, but every change (a setting, a monitor's Enabled box, Auto-renew, a workflow edit, Scan and Report) needs administrator approval. The bottom-right status badge explains the current state:

Some actions show a second, elevated confirmation dialog titled CertIntel Agent - administrator approval that lists exactly what is about to change ("The CertIntel Agent app is asking to make these administrator changes: ... Approve only if you just made these changes."). It always appears for connecting or disconnecting, installing an update, issuing, renewing or revoking a certificate, Install again, deleting a workflow, saving a secret, resolving a DNS delegation, turning the configuration lock on or off (Agent 1.4.0 and later), Trust this CA on this computer… (adding a CertIntel Private CA root to the machine's Trusted Root store, restricted to TLS server and client authentication in Agent 1.5.0 and later and to TLS server authentication before; see Private CA), Approve… and Reject… for a dashboard assignment (Agent 1.3.95 and later; the approval dialog lists the whole proposal - certificate, names, issuer, every template setting and whether issuance starts at once - and approves exactly that revision, splitting a long template setting into numbered parts; an assignment too long for the dialog is approved from an elevated prompt with certintel assignments approve ID --revision N instead; the rejection dialog shows the reason that will be sent to the dashboard) and Restore permissions…. For settings changes it appears only when the change is security-sensitive, for example:

• connecting to a different API origin or changing the policy organization;
• adding or changing a TLS probe, certificate file or store monitor target;
• removing a password-protected file monitor (.pfx, .p12, .jks), which also deletes its stored password;
• enabling Check internal endpoints assigned by CertIntel;
• turning on unattended update installation or changing renewal windows;
• turning on auto-apply for dashboard-assigned workflows, or moving it to another organization (Agent 1.3.95 and later). A fresh Agent 1.8.0 or later installation has auto-apply on by default: the consent is recorded as pending at installation and bound at enrollment to the organization the platform reports, so it never carries over to another connection, and an existing installation that upgrades does not gain it. Set it at installation with the ASSIGNMENTAUTOAPPLY install option or change it later with certintel config set assignment-auto-apply=on|off or certintel assignments policy --auto-apply on|off, which also works before the agent is connected and then reports pending;
• adding or changing an ACME account, DNS delegation, workflow step or installation plan.

Notes, enable/disable toggles and theme changes do not trigger the dialog. Choose No if you did not just make the change. After three declined dialogs the approval helper exits and the next change asks for UAC again.

A long change is shown in full across several dialogs. Each dialog holds up to 12 items; a larger change continues in further dialogs titled part N of M, up to five, and is applied only when every part is approved. Declining any part declines the whole change. Lists that grow with the configuration (certificate names, outputs and installations, step inputs, renewal windows, store name filters) are packed into a few items rather than one item per entry, so a certificate with 100 names takes two dialogs to create or issue. A change that still cannot be shown completely within five dialogs is refused with too many security-sensitive changes to review safely at once; split it.

You have twenty minutes to work through the dialogs of one change. An open dialog does not count as idle time, and a timeout is reported as a timeout rather than counted as a decline.

Creating a certificate workflow from a template takes two dialogs in total: one for the DNS delegation check and one for the save. The save dialog lists the follow-up steps of the same setup (storing the delegation, account, workflow and output secrets, enabling the certificate, and issuing and delivering it) and approves them with it, so those steps are not prompted again. Anything not listed, repeated, or combined with another change is reviewed as before, and a declined save grants nothing.

If you run the whole app elevated, Export… for Activity and workflows is disabled and theme choices are not saved for the next launch. Reopen the app normally for those tasks.

Messages you may see in the status bar: Administrator approval was cancelled. The change was not saved., The change was not approved. Nothing was saved., Administrator approval expired. Make the change again to approve it.

Desktop app¶

The app has six sections:

• Overview — certificate, monitor and attention summaries, the Check internal endpoints assigned by CertIntel checkbox, and Cloud-assigned monitor results.
• Workflows — create and manage certificate renewals (ACME, or a CertIntel Private CA when the platform offers it to this Agent; Agent 1.3.93 and later list the Private CA entry disabled, with the reason, until it can be used), storage and installation, with a Renewal due column and a History… button per certificate. Agent 1.4.0 and later show in the Renewal due tooltip whether the date comes from the CA's renewal window (ARI) or the certificate's lifetime, and the window itself; see when a certificate renews. A renewed certificate waiting for its deployment window shows Waiting for deployment window. Agent 1.5.0 and later group the templates of + New certificate workflow under Appliances (remote) and Microsoft services too, and offer Detect servers on this computer… to pre-fill a template from this machine's bindings (Server detection).
• Agent Monitors — TLS probes (Add TLS probe…), certificate files (Add file…), Windows stores (Add store…), Configure AD CS Template - Agent… and CRL Distribution Point - Agent entries (add, edit, enable/disable, delete; see CRL monitoring).
• Activity — recent activity with search, Show debug details, History (Latest 500 or All retained logs, loaded in batches with Older), Copy and Export…. Search narrows the displayed page.
• Settings — connection, Appearance, Schedules, Log retention, Renewal windows, Deployment window (Agent 1.4.0 and later: the Agent default deployment window and Report the redacted end of a failed step's output to CertIntel), Configuration lock (Agent 1.4.0 and later, above), Platform credentials (appliances) (Agent 1.5.0 and later, see Remote & appliance deployment), Secret and configuration permissions, and Updates.
• Jobs — queued and recent operations.

Scan and Report, Test connection, Refresh and Pause auto-refresh are at the top of the window. Settings and individual configuration actions apply immediately (after approval); there is no global Save button. Workflow studio keeps a draft until Save workflow; see the studio walkthrough. Whole-number settings outside their range are rejected with Enter a whole number from {min} to {max}. The previous setting is still active.

Schedules¶

Settings → Schedules shows each recurring activity with its last and next run, an interval and a run-now button. Times are the computer's local time.

The defaults can be set for a fleet at installation time with the MSI install options and changed afterwards with certintel config set (Agent 1.8.0 and later).

Scan now queues a discovery job; Check now and Purge now mark the activity due and wake the service without changing its schedule. The internal-endpoint interval only controls how often the agent asks CertIntel for due assignments; CertIntel decides how often each endpoint is probed. That row shows Disabled until you turn on Check internal endpoints assigned by CertIntel on Overview.

The renewal check interval is a safety net, not the renewal clock. The service wakes on its own for each certificate's renewal date, retry delay, revocation follow-up, installation retry and (Agent 1.4.0 and later) next check of the CA's renewal window and the opening of a deployment window; the interval only bounds how long the service goes without evaluating every certificate when none of those is pending. With renewal windows configured, the scheduled check runs once per window at a random time inside it instead, and an overdue renewal is spread into the window the same way.

After installing a managed certificate, re-check monitored TLS endpoints it covers (on by default) re-probes your local TLS monitors whose host is one of the new certificate's names right after installation, so the inventory shows the new thumbprint without waiting for the next scan. See Monitors & internal endpoints.

Log retention¶

Normal logs (days, 1–3650) and Debug logs (days, 1–3650) control how long the journal is kept (defaults 120 and 30). Debug entries are always recorded; show them on Activity with Show debug details. Reducing retention asks for confirmation because older files are removed.

Appearance and Tenant override¶

Under Settings → Appearance, Visual theme offers Brutal, Classic Blue, Liquid and Phosphor, and Color mode offers Light or Dark per Windows user. On supported plans the tenant administrator chooses the tenant theme in the dashboard. An approved, install-token-enrolled Agent follows that theme and any customized button colors after receiving branding from the platform; Refresh platform theme fetches it now.

Turn Tenant override on to choose a local theme for this server and stop platform check-ins from changing it; turn it off to follow the tenant again. Agents connected with an integration API key always use the local theme. Windows high-contrast settings take priority. The appearance status line explains whether the agent is following the tenant, overriding it, waiting for approval, or could not obtain branding.

Updates¶

Update checking is on by default; unattended installation is opt-in. Control both under Settings → Updates (Check for agent updates, Automatically install verified updates, Check now, Install update), pass AUTOUPDATEINSTALL=1 (and, in Agent 1.8.0 and later, UPDATECHECK=0|1) at MSI installation, or run certintel config set update-auto-install=on afterwards (Agent 1.8.0 and later). The service compares two independent release records:

• https://assets.certin.tel/downloads/agent/latest/info.json
• https://api.certin.tel/api/v1/releases/agent/latest.json

Both must be fresh (records are re-signed on a schedule and expire after 30 days), signed by the Agent's built-in Ed25519 trust root, and exactly equal. They bind the version, platform, immutable download URL, exact byte size and SHA-256. The downloaded MSI must also pass Authenticode signer and MSI identity checks and be a newer version than the one installed; the agent never rolls back. The service rechecks both records after download, then runs Windows Installer quietly with a log at C:\ProgramData\CertIntelAgent\update-install.log. Activity records update-available, update-started and update-failed events; started means the installer launched, so confirm the version and service health afterwards.

From an elevated prompt, certintel update check and certintel update install do the same.

Update requests from the dashboard¶

Agent 1.5.0 and later take update requests from CertIntel. A user with the agent_updates.create permission (Operator and Administrator) chooses Update now on the Agent's page or Update all outdated on the Agents list, where an Update available x.y.z pill marks outdated Agents. The platform requests; the device decides:

• The Agent picks the request up with its next heartbeat, within about an hour.
• It installs only the version in the signed release manifest it verifies itself (at least the requested version and newer than the running one), never a download address from the platform and never an older version.
• It installs only when Automatically install verified updates is on locally; otherwise it refuses (automatic installation is off on the device). The configuration lock does not block signed updates.
• It reports each step; the dashboard shows Update requested, Update request sent to the agent, Update accepted, Installing the update, Updated, Update refused or Update failed. The new version reports the result after it starts.
• A request the Agent has not finished expires after 7 days (168 hours) (Update request expired). While it has not been sent yet, Cancel request withdraws it (agent_updates.delete).
• Agents before 1.5.0 show Requires Agent 1.5.0 and are skipped by Update all outdated; update them on the device.

Linux uses a different, CLI-driven installation path, and automatic installation on Linux is not available in this release; see Linux Agent.

Upgrade, repair and removal¶

MSI upgrades preserve Agent data and the connected credential. Before the installation commits, the MSI checks the installed CLI version and service health; a mismatch fails the installer transaction and rolls back.

An interactive uninstall asks Remove all CertIntel Agent data too? and explains that this unregisters the agent (flagging its API key for review) and permanently deletes locally stored certificates, private keys, workflow configuration and logs. No (the default) keeps the data for a later reinstall. A silent uninstall keeps data unless you pass REMOVEALLDATA=1:

msiexec.exe /x "{ProductCode}" REMOVEALLDATA=1 /qn /norestart

Data removal is all-or-nothing: if a folder or registry key cannot be deleted the uninstall fails with CertIntel data erasure was incomplete. Protected data may remain. Fix the lock or permission problem and retry with REMOVEALLDATA=1. Exported certificates in other application directories are never removed by this cleanup.

Settings → Secret and configuration permissions (Check permissions, Restore permissions…) checks or restores access for SYSTEM and Administrators on the agent's configuration and encrypted secret files. Saved keys and settings are retained; folder permissions, jobs, logs and exported certificate files are not changed. Both actions ask for administrator approval when the app is not elevated. CLI equivalents:

certintel permissions check
certintel permissions restore

Secrets use machine-scope DPAPI and restrictive ACLs. This protects against unrelated unelevated users, not against LocalSystem or a local administrator.

Next steps¶

• Create certificate workflows and installation plans
• Use workflow variables, conditions, and deployment examples
• Configure monitors and internal endpoints
• Monitor certificate stores and files
• Connect Delegated DNS-01
• Understand install-token approval