Dawnstar Labs Vardhold Docs

Install and deploy

Vardhold ships as one standard per-machine MSI, so it deploys like any other Windows software. This page covers silent installs, fleet policy, upgrades and removal.

3 min readUpdated October 2026Vardhold 0.1 (pre-release)

On this page
  1. Before you roll out
  2. Installer options
  3. Deploy with your tool
  4. What the installer does
  5. Roll out a policy to the fleet
  6. Upgrade
  7. Uninstall

Before you roll out#

  1. Verify the installer. Every release is Authenticode-signed by Dawnstar Labs. Check it before you upload it to your deployment tool:
    PowerShell
    Get-AuthenticodeSignature .\Vardhold-0.1.0-x64.msi | Format-List Status, SignerCertificate

    Status must be Valid.

  2. Keep the SBOM. Each release has a CycloneDX software bill of materials (sbom.cdx.json), attached to the release and installed with the product. Keep the one for each version you deploy.
  3. Pilot first. Install on a few developer machines in monitor mode for a week, review what the agents do, then tune the policy before you enforce it everywhere.

Installer options#

PropertyDefaultEffect
INSTALLCLAUDEHOOK1Registers the Claude Code hook in managed settings for every user. 0 skips it.
INSTALLCURSORHOOK1Registers the Cursor hooks in C:\ProgramData\Cursor\hooks.json. 0 skips it.

Standard msiexec switches apply: /qn for silent, /norestart, and /l*v for a verbose log. Vardhold does not need a restart.

PowerShell
msiexec /i Vardhold-0.1.0-x64.msi /qn /norestart /l*v "$env:TEMP\vardhold-install.log"

Deploy with your tool#

  1. In the Intune admin center, go to Apps → Windows → Add and choose Line-of-business app, then upload the MSI. Intune reads the product code and version from it.
  2. Add any properties to Command-line arguments, for example INSTALLCURSORHOOK=0.
  3. Set the install context to Device, then assign the app to a device group as Required.

To control the install command and detection rule yourself, wrap the MSI as a Win32 app (.intunewin) instead and use the silent command above.

  1. Create an Application from the MSI (Windows Installer, automatic detection).
  2. Change the installation program to include the properties you need:
    Command Prompt
    msiexec /i "Vardhold-0.1.0-x64.msi" /qn /norestart INSTALLCLAUDEHOOK=1 INSTALLCURSORHOOK=1
  3. Set the installation behaviour to Install for system and deploy to a device collection.
  1. Copy the MSI to a share that domain computers can read.
  2. In a GPO, go to Computer Configuration → Policies → Software Settings → Software installation and add the package as Assigned.
  3. Link the GPO to the computers' OU. Vardhold installs at the next restart.

Group Policy cannot pass installer properties directly. To change the hook defaults, apply a transform (.mst) that sets them.

For other tools, or a one-off install from an elevated prompt:

PowerShell
$msi = "\\fileserver\software\Vardhold-0.1.0-x64.msi"
if ((Get-AuthenticodeSignature $msi).Status -ne 'Valid') { throw "Installer signature is not valid." }
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$msi`" /qn /norestart"
Get-Service Vardhold

What the installer does#

  • Installs to C:\Program Files\Vardhold and creates %ProgramData%\Vardhold, limited to SYSTEM and Administrators. Anything already in that folder is taken over.
  • Registers the Vardhold service (automatic start, restart on failure) and starts it.
  • Registers the agent hooks you selected, machine-wide, in places only administrators can change.
  • Starts the tray app for signed-in users right away, and at every sign-in after that.
  • Writes the default policy on a new install. An upgrade keeps your policy, settings and audit data.

Roll out a policy to the fleet#

Write and test the policy on one machine first (the dashboard's dry run shows what it would change). Then push it with the same tool you deploy with, running the CLI as SYSTEM or an administrator:

PowerShell
$cli = "C:\Program Files\Vardhold\vardhold.exe"
& $cli policy validate .\org-policy.yaml
if ($LASTEXITCODE -eq 0) { & $cli policy apply .\org-policy.yaml }

Every applied policy is versioned and sealed in the audit log, with who applied it. A central console for policy distribution, fleet inventory and central approvals is on the roadmap.

Upgrade#

Install the new MSI over the old one with the same command. The upgrade replaces the binaries and keeps the policy, settings and audit data. If anything fails, Windows Installer rolls the machine back to the version that was there.

Installing Vardhold over AgentGuard, its earlier name, replaces it and cleans up the old hooks and firewall rules. The old audit data in %ProgramData%\AgentGuard is kept as evidence and stays protected.

Uninstall#

PowerShell
msiexec /x Vardhold-0.1.0-x64.msi /qn

Uninstalling removes the hooks, restores the MCP client configurations Vardhold changed, and removes any firewall rules it added. The audit data in %ProgramData%\Vardhold is kept as evidence; delete it separately once your retention requirement allows.

Remove Vardhold only from Settings → Apps or your management tool. A removal started from a terminal an AI agent opened is blocked as an attempt to disable protection.