Installation Lifecycle

A new installation token must be generated in the WitnessAI Console.
Customers must also generate and deploy new installation scripts that reference the new token for any new device registrations.
Existing devices do not need to be reinstalled or updated.

Witness Anywhere uses script-based deployment.

Installation and removal scripts are not persistent agents.
Scripts do not self-update.
Script updates require redeployment using the customer’s endpoint management system (MDM, EDR, or GPO).

Customers should treat scripts as versioned deployment artifacts and manage rollout through standard IT change control processes.

Installation tracking depends on the deployment method used.

Installation success and failure can be tracked using reports available in the respective EDR consoles.

Scripts execute on the client side and do not report status back to Active Directory. There is no centralized reporting through GPO.

Additional notes:

Installation scripts generate local logs on the endpoint to record execution results.
Script exit codes indicate success or failure.
WitnessAI can provide a registered devices report from the backend upon request.

Witness Anywhere does not currently provide centralized install telemetry in the console.

Witness Anywhere does not expose installed script or component versions in the console.

Customers can track installed components using:

Endpoint software inventory (for example, checking the installed Stunnel version via the system software list)
Deployment scripts used for installation, which identify the bundled Stunnel version

The WitnessAI backend does not store or report Stunnel version information for deployed devices.

When WitnessAI releases updated installation scripts:

This ensures predictable behavior and customer-controlled change management.

Witness Anywhere relies on system proxy and PAC configuration to enforce traffic routing.

If users can modify proxy settings, enforcement may be bypassed.

Recommended controls:

The registration script includes an optional proxy lock feature that prevents standard users from modifying system proxy and PAC settings.

This behavior is controlled by a configurable variable in the installation script.

(Default value is false.)

Proxy lock configuration example (plain text):


$proxylock = $false 
# Change value to $true to prevent users from changing system proxy settings.

Customers may manually update this value prior to deployment if stricter enforcement is required.

This setting is typically managed through MDM or script customization workflows.

Witness Anywhere deploys Stunnel as a local encrypted proxy component.

Stunnel upgrades are delivered through updated installation scripts provided by WitnessAI.

The recommended upgrade path is:

Run the Flush script
Download and deploy the new Register script that contains the updated package

In certain cases, WitnessAI may provide a targeted patch script for Stunnel upgrades if required.

Additional notes:

WitnessAI uses Stunnel only for its core upstream TLS tunneling functionality.
Stunnel is upgraded only when vulnerabilities affect core functionality or required features.
WitnessAI enforces strict backend security controls, allowing only authorized traffic through Stunnel connections.
When Stunnel updates are released, release notes will document: