Running scan-and-fix across your whole Windows fleet

Running winsentinel --audit on your own laptop takes about a minute and hands you a prioritized list of what to fix. That is genuinely useful, and on a single machine it is the whole job. But security teams do not manage one machine — they manage fifty, or five hundred, and the moment you cross that line the interesting problems stop being “what is wrong with this box” and become “which fix, pushed to which machines, buys me the most posture for the least effort?”

The single-machine agent is the foundation, not the product

WinSentinel’s free tier is a genuinely powerful standalone agent: every audit module, real-time monitoring, scheduled scans, PDF reports, and one-click fixes, all local, all unlimited. Nothing about the fleet story asks you to give that up. The fleet model is the same agent, run on every machine, with one extra capability turned on: the ability to phone home to a control plane and accept remote commands. Free gives you a strong agent per box; Pro turns a room full of those agents into a managed fleet.

Three questions a fleet has that a single machine never asks

Once you are looking at a fleet, three aggregate questions dominate day-to-day work — and none of them are answerable from a per-machine scan report:

• Which finding recurs the most? A single WDigest misconfiguration on one laptop is a shrug. The same finding on 34 of 40 machines is your Tuesday morning. Ranking findings by prevalence tells you which one fix to push first.
• Did my dispatch actually land? When you push “scan now” or “apply this fix” to the fleet, you need to know afterward how many machines completed, how many failed, and how many are still in flight — not just that the command was sent.
• Is the fleet drifting? A machine that passed CIS L1 last week and regressed this week is invisible unless something is watching the trend across every node.

How dispatch works

Each machine runs the WinSentinel agent as a daemon. It performs its local scans on schedule (free, standalone), and — when configured with a Pro license — registers with the control plane and heartbeats every few minutes. An admin dispatches a command from any node or the web console:

winsentinel fleet scan-all
winsentinel fleet push-policy cis-l1.json
winsentinel fleet status

The control plane queues the command per node; each agent picks it up on its next heartbeat, executes locally, acknowledges, and reports the result back. That gives you a full lifecycle you can watch: pending → acknowledged → completed | failed | expired. A dispatch of scan_now to 40 machines is not a fire-and-forget — the console rolls it up into “37 completed, 2 failed, 1 still in flight,” so you know exactly which handful of boxes need a human before you move on.

Policy push: “everyone must pass CIS L1 by Friday”

The highest-leverage fleet action is not a one-off scan — it is pushing a policy: a named set of rules every node is expected to satisfy. Push it once, and every agent evaluates itself against it on every scan and reports compliance. Now “get the fleet to CIS L1” is a dashboard you can watch trend green instead of a spreadsheet you chase.

Start free, scale when you need to

The right way to adopt this is bottom-up. Install the free CLI on your own machine, run an audit, fix what it finds. When you realize you want that same discipline across every machine you are responsible for — with one place to see posture, dispatch fixes, and prove compliance — that is when the fleet control plane earns its keep. The agent you already trust on one box is the same one running the fleet.

See how Free and Pro compare →