---
title: "Agent"
description: "The Agent is the Windows service on each managed endpoint. It reports inventory, applies policy and runs approved work."
url: "https://support.outpostplatform.com/agent/"
product: "agent"
type: "concept"
status: "stub"
ai_summary: "Overview of the Outpost Agent, the Windows service installed on each managed endpoint. Connects outbound to Depot over mutual TLS, reports inventory, applies profiles and policy, runs signed scripts, and carries patching, alerting and remote access."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/agent/index.md"
license: "CC BY 4.0"
---

# Agent

The Agent is the piece of Outpost that lives on the machines you manage. It is a
Windows service, it connects outbound to your Depot and never listens for
inbound connections, and everything Outpost knows about an endpoint arrives
through it. This section is for whoever deploys and troubleshoots it.

<!-- TODO: write this page against the concept template.

Sections:

- What the Agent is, and what it installs.
- How it connects: outbound only, mutually authenticated, one identity per
  endpoint.
- What it reports, and how often.
- What it can be told to do, and what it refuses.
- Why an unconfigured Agent refuses to run an unsigned script, by design.
- The helper process that runs as the signed in user, and why it is separate.
- Updates, and how a new version reaches an endpoint.
- Supported Windows versions.
- What is left behind when it is removed, and what is not.
-->

Follow the [concept template](https://gitlab.com/outpostplatform/docs/-/blob/main/templates/concept.md).