# Install on Windows

> Install the Whisper sensor on Windows: fetch the CLI in PowerShell, sign in, bind the machine, install the service, confirm it is running.

*Source: https://www.whisper.security/docs/endpoint/install/windows*

---
Open PowerShell as Administrator and run all four steps in that one session, under one account. The service needs elevation to install, and the marker written in step 3 lands in the profile of whoever ran it, so switching accounts halfway leaves the service unable to find it.

## 1. Install the CLI

```powershell
irm https://get.whisper.online/install.ps1 | iex
```

The binary lands in `C:\Program Files\Whisper` and configuration lives under `C:\ProgramData\Whisper`. This step installs the CLI and nothing else.

## 2. Sign in

```powershell
whisper login --web
```

The command opens a browser at `https://console.whisper.security` and, on approval, saves your key for the signed-in account.

## 3. Bind the machine

```powershell
whisper enroll
```

```text
whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)
```

That address is what this machine reports as from now on. The command is idempotent, so a re-run after a rebuild re-finds the same address instead of minting a second one. It records the result at `%USERPROFILE%\.config\whisper\bound`, which is why step 4 belongs to the same account. [Bind the host](/docs/endpoint/install/enroll) has the detail.

## 4. Install and start the service

```powershell
whisper service install --now --sensor
```

The service is named `whisper-sensor`. It runs as `LocalSystem`, starts automatically with the machine and restarts itself on failure. Real-time event collection needs that level, which is why the install is elevated.

## 5. Confirm it is running and reporting

```powershell
sc query whisper-sensor
whisper service status --sensor
```

`sc query` answers with the service state, which reads `RUNNING` once step 4 has taken. `whisper service status --sensor` is the one that tells you whether the sensor found the machine's address, rather than just that the process started.

The rolling log is here if you want to watch it work:

```powershell
Get-Content C:\ProgramData\Whisper\logs\whisper-sensor.log -Tail 20 -Wait
```

The machine now appears in [your fleet](/docs/endpoint/operate/fleet), and the address it reports under is checkable by anyone with no key and nothing installed: see [verifying an identity](/docs/identity/verify).