Lookout agent¶
Lookout is Trimtab's read-only Windows agent. It's a set of PowerShell scripts run by two scheduled tasks under the SYSTEM account. There's no service and nothing listening on the network.
What it does¶
- Runs 37 read-only checks covering encryption, malware protection, firewall, accounts, sessions, hardening, audit logging, and patching. See the device check reference.
- Uploads results to the Bridge over HTTPS.
- Queues results locally when offline and uploads them later.
- Never changes a setting. The only side effect is a temporary security policy export that's deleted immediately.
Schedule¶
| Task | When | What |
|---|---|---|
| Trimtab Lookout Scan | Daily at 10:00 (plus up to 15 minutes of random delay), and 15 minutes after startup | Scans the device and uploads the result |
| Trimtab Lookout Upload | Hourly | Uploads anything waiting in the local queue. Does nothing if the queue is empty. |
Missed scans (for example, the device was off) run as soon as possible afterward. Change the daily time with the installer's -DailyAt option.
Run a scan now¶
Start-ScheduledTask -TaskName 'Trimtab Lookout Scan'
The result appears in the Bridge within a minute.