Tanium (Windows)

To register devices with Witness Anywhere you must create a PAC Token. Then you will download the PAC registration scripts. The Tanium bundle includes three files: a deployment script responsible for onboarding and offboarding user devices to Witness Anywhere, along with two sensor scripts used for monitoring purposes.

In the WitnessAI console, go to Administration → Configuration → Proxy. The Proxy Configuration page opens with a Witness Anywhere section.

Proxy Configuration page in the WitnessAI console, opened from Administration > Configuration > Proxy in the left menu, with the Key Name and Expiration Date fields, the Generate PAC Token button and the PAC token list

Type your preferred token name in the Key Name field and select the Expiration Date.

The Expiration Date should allow time for you to complete the current deployment, for example 30 days.

Once a device has been registered with Witness Anywhere, the token is no longer required. If a token expires, devices that were already deployed and successfully onboarded will continue to function normally. The token is only required during initial deployment.

Click Generate PAC Token. When it completes you will see this message flash briefly on your screen:

Download Device Registration Scripts

To download the generated scripts, navigate to the row with your chosen Key Name in the Name column and click the corresponding download symbol on the right side.

PAC token list with columns NAME, EXPIRATION, SCRIPT and ACTIONS; the download icon in the SCRIPT column opens the download dialog

In the new pop-up window, select Platform as Tanium (Windows) (7), then click Download (8).

This will download a ZIP file with a long random name (e.g., 7786b0568ec6f80f256350ca7786b0568ec6f80f256350ca.zip). Rename it to something meaningful like WitnessAI_scripts.zip and unzip it. Inside the folder, you will find the following files:

ps1: A Tanium deployment script used to onboard and offboard devices to Witness Anywhere.
ps1: A sensor script used to monitor the status of Witness Anywhere.
ps1: A sensor script used for detailed monitoring and reporting.

Creating the Witness Anywhere Sensors

Witness Anywhere Status Sensor

A simple single-column sensor that returns Yes / No / Partial for each endpoint, reflecting overall Witness Anywhere configuration.

Steps

In the Tanium Console, go to Content → Sensors.
Click New Sensor.
On the Details tab set:

Name: Witness Anywhere Status
Description: Returns overall Witness Anywhere status.
Content Set: Select your content set.
Result Type: Text

Go to the Implementation tab:

Script Type: PowerShell
Paste in the contents of ps1 script

Test using Preview.
Save.

Witness Anywhere Status Details Sensor

A multi-column sensor returning one row per user hive with PAC URL, AutoConfigURL, VDI script/task state, and stunnel status.

Steps

Go to Content → Sensors.
Click New Sensor.
On the Details tab set:

Name: Witness Anywhere Status Details
Description: Returns per-user, per-hive Witness Anywhere configuration.
Result Type: Text

Go to the Implementation tab:

Script Type: PowerShell
Paste in the contents of witness_anywhere_details_sensor.ps1 script

Enable Split Results:

Delimiter: |
Columns in order: User, PAC Configured, PAC URL, Autoconfig URL, VDI Configured, VDI Script Installed, VDI Task Configured, Stunnel Running, Stunnel Listening

Test using Preview.
Save.

Creating the Witness Anywhere Deployment Packages

Witness Anywhere Register Device Package

The package is responsible for registering endpoints with the Witness Anywhere platform. It supports both physical endpoints and VDI environments, including single-user and multi-user VDI hosts.

Steps

Go to Content → Packages.
Click New Package.
On the Details tab:

Name: Witness Anywhere Register Device
Description: Manages device registration and required PAC configuration to onboard devices to the Witness Anywhere platform.

Upload the witness_anywhere_deployment_script.ps1 file to the Files tab.
On the Command tab, enter: cmd.exe /d /c powershell.exe -ExecutionPolicy Bypass -File ".\witness_anywhere_deployment_script.ps1" -Token "$1" -Tenant "$2" -Stunnel $3 -VDI $4 -MultiUser $5 -ProxyLock $6 -StaticDomain "$7" -EmailHelper $8

Parameters tab:

$1 Token (required, set a default if desired)
$2 Tenant (required, set a default if desired)
$3 Stunnel (checkbox)
$4 VDI (checkbox)
$5 Multi-User (checkbox)
$6 ProxyLock (checkbox)
$7 StaticDomain (set a default if desired)
$8 EmailHelper (checkbox)

Save.

Witness Anywhere Flush Package

The package performs a comprehensive cleanup of all Witness Anywhere-related configurations on an endpoint. It removes PAC settings, associated registry entries, stunnel components, and any scheduled tasks created for VDI environments.

Steps

Go to Content → Packages.
Click New Package.
Name: Witness Anywhere Flush
Upload the witness_anywhere_deployment_script.ps1 file to the Files tab.
Command:cmd.exe /d /c powershell.exe -ExecutionPolicy Bypass -File ".\witness_anywhere_deployment_script.ps1" -Flush -VDI $1 -MultiUser $2
Save.

Deploying Witness Anywhere Packages

Deploying the Register Device Package

Use Interact to deploy the Witness Anywhere registration package to endpoints that report No or Partial.

Steps

Ask a question such as: Get Computer Name and Witness Anywhere Status and Witness Anywhere Status Details
Filter for Status = No or Partial.
Select rows → Deploy Action.

Choose Witness Anywhere Register Device package.
Enter the below parameter values:

Token - Witness Anywhere Registration Token, obtained from Administration → Configuration → Proxy in the WitnessAI console - [Mandatory]
Tenant WitnessAI Tenant Address [Mandatory]
Stunnel - Enable the check box to deploy Stunnel
VDI - Enable the check box if package is being deployed on a VDI Host
Multi-User - Enable the check box if package is being deployed on a Multi-User VDI Host
Proxy Lock - Enable the check box if the System Proxy settings should be locked for end users.
Static Domain - Define the static domain value if the domain value on the device differs from the actual email domain value.
Email Helper - Enable the check box if using Email Helper script for Email extraction.

Review targeting and deploy.

Deploying the Flush Package

Filter sensors for Witness Anywhere Status = Yes.

Select devices → Deploy Action.
Choose Witness Anywhere Flush package.
Enter the below parameter values if required:

VDI - Enable the check box if package is being deployed on a VDI Host
Multi-User - Enable the check box if package is being deployed on a Multi-User VDI Host

Review targeting and deploy.

Targeting Questions & Advanced Scoping

Tanium targeting can be based on sensors, operating system, domain state, or other environmental attributes. Administrators can define targeting questions such as:Witness Anywhere Status equals No or Partial AND OS Family = Windows.

Administrators can define custom questions to identify and filter devices that fall within the deployment scope.

Reporting

The two sensors defined can be used to form questions and generate reports of devices enrolled to Witness Anywhere which can be exported out as a CSV from Tanium.

Tanium (Windows)Generate Witness Anywhere Registration Scripts Creating the Witness Anywhere Sensors Witness Anywhere Status Sensor Witness Anywhere Status Details Sensor Creating the Witness Anywhere Deployment Packages Witness Anywhere Register Device Package Witness Anywhere Flush Package Deploying Witness Anywhere Packages Deploying the Register Device Package Deploying the Flush Package Targeting Questions & Advanced Scoping Reporting