Managed enterprise

Windows managed enterprise provides the same security properties as the Linux and macOS service deployments through Windows-native controls: Service Control Manager (SCM) services, NTFS DACLs, a restricted gateway identity, and a LocalSystem hook guardian.

For the complete config, target manifest, staging, attestation, and validation procedure, use Enterprise hardening and deployment.

Security parity and Windows boundaries

The gateway cannot write arbitrary interactive-user profiles. The guardian uses the exact active, non-elevated token for each SID in targets.yaml, then returns to LocalSystem before publishing protected authorization state.

What a standard user cannot disable

A standard user, including an AI agent running as that user, cannot stop, pause, reconfigure, delete, or replace either SCM service; modify protected binaries or policy; change the service mode pin; read service-side scoped credentials; or forge guardian authorization.

The user still owns parts of the native agent profile. Deleting or editing a user-owned hook can therefore create a short bypass window before repair; the guardian makes that change non-persistent, not impossible. Use WDAC, AppLocker, MDM, EDR, or filesystem policy when the hook itself must be immutable. A fully elevated administrator or LocalSystem remains a trusted authority and is outside this threat boundary.

See the cross-platform threat model, the exact non-admin guarantee, and the repository's Windows threat model.

Qualified connectors

Managed enterprise on native Windows is qualified only for codex and claudecode targets. Other connectors remain outside the Windows enterprise certification boundary.

• Codex: version 0.133.0 or newer is required. Production enforcement uses the shared managed hook policy. WDAC or AppLocker can optionally restrict which client binaries may start, but is not required to install the hooks.
• Claude Code: version 2.1.152 or newer is required. Production acceptance also requires proof from the real approved client that DefenseClaw's managed policy remains effective against hostile user and project settings.

Follow the connector-specific acceptance rules for Codex and Claude Code.

CLI lifecycle

The signed enterprise CLI exposes the same administrator lifecycle as the packaged Windows transaction. The shared signed Go command surface is available under either executable name — defenseclaw.exe (the elevated administrator CLI) or defenseclaw-gateway.exe (the same command set invoked through the gateway binary). Both accept the enterprise windows ... command family identically. The Python defenseclaw CLI does NOT expose this family; it is signed-Go-only.

Install, repair, upgrade, reconcile, verify, and uninstall are administrator operations. The CLI does not self-elevate. For an interactive deployment, open one terminal with Run as administrator, approve that Windows UAC prompt, and run the lifecycle from the same elevated session; each command does not need a new prompt. A standard user without administrator credentials cannot cross or bypass that boundary. Trusted endpoint management running as LocalSystem does not need interactive UAC consent. The operator shell may be PowerShell 7, but the signed CLI intentionally launches the fixed in-box Windows PowerShell executable internally as part of its trusted transaction. That is not a general PowerShell 5 support promise. The disposable-host certification harness itself requires 64-bit PowerShell 7.

Every lifecycle command accepts --json. Install, repair, and upgrade require the complete approved gateway, hook, config, and manifest input set. Do not copy a partial command from this overview; use the exact install and repair/upgrade/uninstall examples.

Guardian verification

After installation or any target change, reconcile through the Windows lifecycle and use the generic enterprise-hook commands only for read-only target diagnostics:

$Gateway = 'C:\Program Files\Cisco\Cisco Secure Client\DefenseClaw\bin\defenseclaw-gateway.exe'
$Manifest = 'C:\ProgramData\Cisco\Cisco Secure Client\DefenseClaw\hook-guardian\targets.yaml'

& $Gateway enterprise windows reconcile --json
& $Gateway enterprise hooks status --manifest $Manifest --json
& $Gateway enterprise hooks verify --manifest $Manifest --json

Do not run enterprise hooks install, reconcile, watch, or generic user-footprint uninstall directly from an elevated user shell on Windows. Those mutations belong to the LocalSystem guardian so it can impersonate the exact target SID safely. See Reconcile and verify Windows targets.

Upgrade, automatic rollback, and removal

Upgrade is transactional. A validation or staging failure leaves the previous verified deployment running; a failed activation automatically rolls back instead of publishing mixed versions as healthy. There is no public enterprise windows rollback command. After an upgrade, require lifecycle status and verify, guardian status and verify, and an allow/block connector check.

Default uninstall removes the services, installed binaries, and only DefenseClaw-owned Codex and Claude integration leaves. It retains runtime, logs, guardian evidence, and deployment diagnostics for recovery. --purge removes managed DefenseClaw state, but neither form recursively deletes the shared C:\ProgramData\OpenAI\Codex or C:\Program Files\ClaudeCode parent. Restart open Codex and Claude Code sessions after decommissioning so they do not retain cached hook commands.

Use Verify Windows service hardening for rollout acceptance and the canonical production checklist before declaring an endpoint protected.