Admin CLI

Run management commands from an elevated prompt: they read the administrator token, which only Administrators can read. version and policy validate (without --server) work without elevation.

Commands#

status#

vardhold status [--json]

Shows the version, mode, kill switch state, policy version, agents and endpoint capabilities. --json prints the full status object for scripts.

policy#

vardhold policy validate <file> [--base-dir DIR] [--server]
vardhold policy show [--version N]
vardhold policy apply <file>

• validate checks a policy file and prints each error with its line number. --server asks the running service instead of checking locally; --base-dir sets where list files such as host_not_in are read from.
• show prints the active policy, or a version from the history.
• apply validates and applies the file as a new policy version.

mode#

vardhold mode <monitor|enforce|strict>

killswitch#

vardhold killswitch <engage|release|terminate>

engage blocks every checked action, denies pending approvals and suspends agents. terminate ends agent processes instead. release returns to normal.

export#

vardhold export [--format ocsf|cef|json] [--from TIME] [--to TIME] [--agent ID] [--output FILE]

Exports events for a time range and, optionally, one agent. Without --output it writes to the console.

verify#

vardhold verify [--offline] [--db PATH] [--anchor ID:HASH]

Checks the integrity of the audit log: the keyed chain, the sealed approvals, alerts and policy versions, and the record of the chain head.

• --anchor ID:HASH also checks that the log still holds an event id and hash taken from your SIEM (metadata.sequence and metadata.uid), which catches a rollback or rewrite of the whole log.
• --offline checks the database directly, without the service; --db points it at a copy.

version and cleanup-integrations#

vardhold version
vardhold cleanup-integrations [--profiles DIR;DIR] [--keep-hook]

cleanup-integrations restores MCP client configurations and removes the hooks. The uninstaller runs it for you; you should not normally need it.

Connection options#

Exit codes#

In scripts#

$cli = "C:\Program Files\Vardhold\vardhold.exe"
& $cli verify
switch ($LASTEXITCODE) {
  0 { "Audit log intact" }
  3 { "Vardhold service is not running" }
  4 { Write-Error "Audit log integrity check failed" }
}