How is the SuperClue Fleet agent installed on Windows?

• Windows endpoints. The Fleet agent runs on Windows only; for Linux and macOS use the SOC agent.
• Local administrator rights on each endpoint, or a Group Policy, Intune or SCCM setup that installs software as SYSTEM.
• Outbound HTTPS (port 443) from each endpoint to SuperClue.
• Credits: 30 per endpoint registered individually or 20 per machine that joins through a deployment package, 0.02 per heartbeat (every 60 seconds by default) and 0.05 per DLP event.

1. 1

   Ask SuperClue to enrol your endpoints

   Fleet enrolment is handled by the SuperClue platform team. Write to agent@superclue.io with the number of Windows endpoints and how you want to deploy: one installer per machine, or a package for Group Policy, Intune or SCCM.

2. 2

   Receive the installer or package

   For single machines you get an installer for each endpoint. For mass deployment you get a package that carries a deployment token, so each machine registers itself the first time the installer runs.

3. 3

   Run it with administrator rights

   On a single machine, right-click the installer and choose Run as administrator. For many machines, assign the package through Group Policy, Intune or SCCM as you would any other software.

4. 4

   Check that the service is running

   The installer sets up the agent in C:\ProgramData\SuperClueFleet and starts the SuperClueFleetSvc service. Run this in an elevated Command Prompt or PowerShell:

   sc query SuperClueFleetSvc

sc query SuperClueFleetSvc should report the state as RUNNING. The agent sends a heartbeat every 60 seconds by default. The platform team sees each endpoint check in on the Fleet console and can confirm the enrolment to you.

• Watches 14 data loss prevention channels, including USB drives, the clipboard, printing, cloud-sync folders, webmail and messenger file transfers.
• Takes remote commands such as blocking an app, disabling USB storage, locking the device or remote wipe.
• Installs agent updates pushed from SuperClue.

Read more on the Fleet agent page.

Run the uninstall script from your deployment package, Uninstall-SuperClueFleet.ps1, in PowerShell as Administrator. It stops and removes the service and its firewall rules, then deletes C:\ProgramData\SuperClueFleet.

powershell -ExecutionPolicy Bypass -File .\Uninstall-SuperClueFleet.ps1

On a single machine you can also remove the service with the agent binary, from an elevated prompt:

"C:\ProgramData\SuperClueFleet\superclue_agent.exe" uninstall

Then ask the platform team to remove the endpoint from your fleet.