Getting Started

Getting started

The shortest path from a bare Windows machine to a device visible in your ReportMate dashboard. You need administrator rights and the URL of a running ReportMate API.

1. Install osquery

The agent shells out to osqueryi.exe for most of its raw data.

winget install --id osquery.osquery --silent --accept-package-agreements --accept-source-agreements

The agent expects it at C:\Program Files\osquery\osqueryi.exe. If yours is elsewhere, set OsQueryPath — see Configuration.

2. Install the agent

Download ReportMate-<version>.msi from the releases page and install it.

msiexec /i ReportMate-<version>.msi /qn

Releases are unsigned. For fleet deployment, sign the payload with your own certificate first — see Installation.

3. Point it at your API

From an elevated shell, write the API URL to the machine settings key:

New-Item -Path 'HKLM:\SOFTWARE\ReportMate\Settings' -Force | Out-Null

Set-ItemProperty -Path 'HKLM:\SOFTWARE\ReportMate\Settings' -Name 'ApiUrl' -Value 'https://reportmate.example.com'

If your API requires a client passphrase, add it the same way. The next elevated run moves it into the protected credential store and blanks the readable copy:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\ReportMate\Settings' -Name 'Passphrase' -Value '<passphrase>'

The Managed Reports Runner App does the same from its Prefs tab after Unlock. For a fleet, set the same values by MDM under HKLM\SOFTWARE\Policies\ReportMate instead; see Configuration.

4. Check what the agent sees

managedreportsrunner.exe info -v

This prints the device id, serial number, resolved API URL, whether osquery is available and which version. If Serial Number is empty or the API URL is blank, stop here and fix that first: the agent refuses to register a device without a real hardware serial.

5. Do a first collection

Start small, without transmitting:

managedreportsrunner.exe --run-module inventory --collect-only -vv

Then a real check-in:

managedreportsrunner.exe --run-modules inventory,system -vv

A successful run logs the payload size, the POST to /api/v1/events, and the device serial used for routing. The device then appears in the dashboard.

6. Let the schedule take over

The installer already registered the collection tasks. Confirm them:

Get-ScheduledTask -TaskName 'ReportMate*' | Select-Object TaskName, State, LastRunTime

The installer has also started a first check-in in the background: a --hello that lists the device within seconds, then a full collection. From here the machine reports on its own: security-relevant modules hourly, software and inventory every four hours, a deep hardware scan daily, and a full sweep overnight. The schedule is described in Installation.

If nothing arrives

• Look at C:\ProgramData\ManagedReports\logs\reportmate-*.log.
• Check whether the payload was written anyway: C:\ProgramData\ManagedReports\cache\<timestamp>\event.json.
• Re-send it: managedreportsrunner.exe transmit -v.

Troubleshooting covers the failure modes the code actually produces.