For the last few releases, RemotePower's Windows support was… let's be honest, "kind of there." The agent ran, it reported in, but it did so as a scheduled task that quietly died if the box hiccuped, and half the things that were effortless on Linux needed hand-holding on Windows.
6.2 — codename "Daem0nMatters" — is the release where I stopped apologizing for that.
The agent is now a real service, everywhere
The headline change is boring in the best way: the agent runs as a proper supervised service on every OS it supports.
- Windows — an actual Windows service (via pywin32), registered with the Service Control Manager. It shows up in services.msc, and the SCM restarts it if it crashes. No more scheduled-task-that-silently-stops. (If you've ever fought "Error 1053: the service did not respond in time" — that self-heals now.)
- macOS — a launchd job with KeepAlive.
- Linux — systemd, as before.
The practical upshot: the agent survives reboots and crashes on its own, on the OS where that was least true before.
Onboarding a Windows box is now a one-liner
Just like Linux. You paste one elevated-PowerShell line:
iwr /install.ps1?t= | iex
…and it downloads the agent, verifies its SHA-256, installs Python if it's missing (winget on modern Windows, the official python.org silent installer otherwise), enrolls with a one-time token, and registers the service. Nothing else to configure on a bare box.
It actually understands Windows now
A Windows host isn't just "a Linux host with worse paths," so the agent stopped pretending. New this release:
- Security posture as first-class checks — BitLocker volume status, Windows Defender real-time protection and signature age, the Windows Firewall per profile, and the Windows Update service all render as Checks rows, drive alerts, and now show at-a-glance in the device drawer. "Real-time protection is off on WEB03" is a thing you find out before it matters.
- A windows_service check type — the analogue of systemd_unit: "is service X running?" via Get-Service.
- Real Event Log reading — a persistent RecordId cursor (so you don't re-ingest or miss events across restarts), the Security channel, and Event IDs.
And two genuinely embarrassing bugs got fixed along the way: the self-updater used to report success even when it failed (rc=0 unconditionally), and it resolved helper binaries by bare name — a SYSTEM PATH-hijack waiting to happen. Both closed, and the self-update is signature-checked when you enable signed updates.
The rest of 6.2, briefly
Windows was the theme, but it rode in with a batch of gap-closing:
- A governed AI executor — you can ask the assistant to remediate a host, but it can only pick one action from a catalog you wrote, by exact id. It can't author a command, so there's no prompt-injection path to a shell.
- A PII scan (cards by Luhn, national IDs, IBANs, emails), EDR coverage reporting (cross-references Wazuh/CrowdStrike/SentinelOne against the real fleet to find hosts with no endpoint protection), and DNS-blocker control (pause Pi-hole/AdGuard for a bounded, self-re-enabling window).
- Three new tripwires: privileged-group changes (sudo/wheel/Administrators), Defender-off, and USB physical-access.
- A host-wide disk-usage explorer for when a mount is 94% and you need to know of what, plus a composite device-reliability prediction.
On the boring-but-important stuff
It's still self-hosted, MIT-licensed, Python + nginx (gunicorn/Flask), with JSON / SQLite / PostgreSQL backends. Every release goes through CodeQL, Bandit and gitleaks, plus a code-level security review; nothing Critical, High or Medium ships. The 6.2 review is in the repo (https://github.com/tyxak/remotepower/blob/main/docs/security-review-6.2.0.md).
If you've been running Linux boxes on it and eyeing the Windows column with suspicion — this is the release to give it another look.
Repo + docs: https://github.com/tyxak/remotepower
Top comments (0)