WitnessAI Documentation
List
Quick Start
Quick Start
User Guide
User Guide
Policies & GuardRails
Policies & GuardRails
Witness Anywhere: Remote Device Security
Witness Anywhere: Remote Device Security
Witness Attack
Witness Attack
Administrator Guide
Administrator Guide
Witness Anywhere Maintenance & Support
Installation Token Lifecycle
Installation tokens are required only for initial device registration.
- Tokens are used to generate installation scripts.
- Once a device is successfully registered, the token is no longer required.
- Token expiration does not affect existing installations.
- Expired tokens prevent new device registrations only.
To onboard additional devices after token expiration:
- A new installation token must be generated in the WitnessAI Console.
- Customers must also generate and deploy new installation scripts that reference the new token for any new device registrations.
- Existing devices do not need to be reinstalled or updated.
Installation Script Lifecycle
Witness Anywhere uses script-based deployment.
- Installation and removal scripts are not persistent agents.
- Scripts do not self-update.
- Script updates require redeployment using the customer’s endpoint management system (MDM, EDR, or GPO).
Customers should treat scripts as versioned deployment artifacts and manage rollout through standard IT change control processes.
Monitoring Installations
Installation tracking depends on the deployment method used.
- CrowdStrike and SentinelOne
Installation success and failure can be tracked using reports available in the respective EDR consoles.
- Windows GPO deployments
Scripts execute on the client side and do not report status back to Active Directory. There is no centralized reporting through GPO.
Additional notes:
- Installation scripts generate local logs on the endpoint to record execution results.
- Script exit codes indicate success or failure.
- WitnessAI can provide a registered devices report from the backend upon request.
Witness Anywhere does not currently provide centralized install telemetry in the console.
Version Tracking
Witness Anywhere does not expose installed script or component versions in the console.
Customers can track installed components using:
- Endpoint software inventory (for example, checking the installed Stunnel version via the system software list)
- Deployment scripts used for installation, which identify the bundled Stunnel version
The WitnessAI backend does not store or report Stunnel version information for deployed devices.
Script Updates & Backward Compatibility
When WitnessAI releases updated installation scripts:
- Existing installations are not modified automatically.
- No service interruption occurs.
- Updates require explicit redeployment by administrators.
This ensures predictable behavior and customer-controlled change management.
Proxy Enforcement & Bypass Prevention
Witness Anywhere relies on system proxy and PAC configuration to enforce traffic routing.
If users can modify proxy settings, enforcement may be bypassed.
Recommended controls:
- Enforce PAC configuration via MDM or Group Policy
- Restrict local administrator access
- Monitor proxy configuration drift
Optional Proxy Lock
The registration script includes an optional proxy lock feature that prevents standard users from modifying system proxy and PAC settings.
This behavior is controlled by a configurable variable in the installation script.
(Default value is false.)
Proxy lock configuration example (plain text):
$proxylock = $false # Change value to $true to prevent users from changing system proxy settings.
Customers may manually update this value prior to deployment if stricter enforcement is required.
This setting is typically managed through MDM or script customization workflows.
Stunnel Maintenance
Witness Anywhere deploys Stunnel as a local encrypted proxy component.
- Stunnel is installed and configured automatically during registration.
- Removal is handled via the Witness Anywhere flush script.
- Customers do not patch Stunnel independently.
Stunnel Updates & Security Patching
Stunnel upgrades are delivered through updated installation scripts provided by WitnessAI.
The recommended upgrade path is:
- Run the Flush script
- Download and deploy the new Register script that contains the updated package
In certain cases, WitnessAI may provide a targeted patch script for Stunnel upgrades if required.
Additional notes:
- WitnessAI uses Stunnel only for its core upstream TLS tunneling functionality.
- Stunnel is upgraded only when vulnerabilities affect core functionality or required features.
- WitnessAI enforces strict backend security controls, allowing only authorized traffic through Stunnel connections.
- When Stunnel updates are released, release notes will document:
- The reason for the update
- Addressed vulnerabilities or issues
- Required customer actions
Made with Bullet