# Install

Put the three Straza binaries on your PATH and check that they came from the Straza release job.

- Who: You, on each machine that runs Straza
- Where: A terminal, or PowerShell on Windows
- Profile: Standalone and enterprise

In short: Straza is three binaries: `strazad` runs the server, `strazactl` administers it and `straza` checks policy beside an agent. You verify a release by its cosign signature and checksums, or build from source. A machine whose agents you govern gets `straza` from a package instead, a deb, rpm, MSI or pkg, which also installs `straza service`.


Strazaisthreeexecutables.Youdownloadasignedrelease,oryoubuildthemfromsourcewithGo.From2.0.0,areleasealsocarriesthe`straza`clientinpackagesthatinstallitsbackgroundservice:adebandanrpmpackageforLinux,anMSIforWindowsonamd64,andapkgformacOS,signedwithaDeveloperIDandnotarizedbyApple.AMaccanbuildthatpackagefromthesourcetreeaswell.|Executable|Purpose||---|---||`strazad`|RunstheStrazaserver||`strazactl`|Administerstheserverfromaterminal||`straza`|Checkspolicybesideanagent|ReleasebuildsexistforLinux,WindowsandmacOS,eachonamd64andarm64.Choosethefilesforyouroperatingsystemandprocessor.[Requirementsandsizing](https://docs.straza.ai/reference/requirements-and-sizing/index.md)liststheplatformsandversionsStrazawastestedwith,andtheprocessors,memoryanddiskeachshapeneeds.ThestepsbelowuseaPOSIXshell,andeachstephasaPowerShellformforWindows.`straza`startsagovernedsessionthrough`strazaservice`,theStrazabackgroundservicethatholdseachmachine'skeyandsessions.TheservicerunsonLinux,macOSandWindows,andsodo`strazad`and`strazactl`.##DownloadareleaseandverifyitEachreleasecarriesonearchiveperplatform,namedaftertheproject,theversion,theoperatingsystemandthearchitecture,forexample`straza_2.0.1_linux_amd64.tar.gz`.Windowsgetsazip,suchas`straza_2.0.0_windows_amd64.zip`.Insidearethethreebinaries,bothlicensefiles,`NOTICE`,`TRADEMARKS.md`,thethird-partynoticesin`THIRD_PARTY_NOTICES.txt`,theREADMEandthestandalonequickstart.Linuxalsogetsthe`straza`clientasadebandanrpmpackageforeacharchitecture.Theirnamesendin`.deb`or`.rpm`inplaceof`.tar.gz`.Windowsonamd64alsogetstheclientasanMSI,whosenameendsin`_windows_amd64.msi`.AMacgetstheclientasonepkgforApplesiliconandIntelMacs,whosenameendsin`_darwin_universal.pkg`.Thepackages,theMSIandthepkgexistfrom2.0.0,andreleasesfrom1.1.2andearliercarrythearchivesonly.Aprereleasesuchas`2.1.0-rc.1`getsneitherthepkgnortheMSI.Besidethearchivessit`checksums.txt`,itssignature`checksums.txt.sig`,thesigningcertificate`checksums.txt.pem`andasoftwarebillofmaterialsforeveryarchive.Apackageholdsthesame`straza`binaryastheLinuxarchiveofitsarchitecture,andtheMSIholdsthesame`straza.exe`astheWindowsamd64zip.Thebillofmaterialsofthatarchiveliststhebinary'smodules.Inthepkg,the`straza`binariesofthetwodarwinarchivesarejoinedintoonefileandsignedwithaDeveloperID,sothebillsofmaterialsofthosearchivescoverit.ThechecksumsfileissignedwithkeylesscosignbytheGitHubActionsjobthatbuilttherelease,sothecertificatenamesthatjob'sidentity.Downloadthearchiveforyourplatform,orthepackageforaLinuxmachine,theMSIforaWindowsmachineorthepkgforaMacwhoseagentsyougovern,andthethreechecksumfilesfromthereleasespageatgithub.com/strazahq/straza/releasesintoonefolder.Thenverifythesignatureandthechecksumthere.Thisneeds`cosign`and`sha256sum`.Terminal,inthedownloadfolder:```shcosignverify-blob--signaturechecksums.txt.sig--certificatechecksums.txt.pem\--certificate-identity-regexp'^https://github\.com/Strazahq/straza/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$'\--certificate-oidc-issuerhttps://token.actions.githubusercontent.comchecksums.txtsha256sum-cchecksums.txt--ignore-missing```Youshouldsee:Bothcommandsexitwithstatus0,and`sha256sum`prints`OK`besideeachfileyoudownloaded.TheidentitypatternpinsthesigningcertificatetotheStrazarepository,itsreleaseworkflowandaversiontag,soasignaturemadeanywhereelsedoesnotverify.###OnmacOSOldermacOSversionshaveno`sha256sum`,sorunthesame`cosign`commandandthencheckthehasheswith`shasum`,whicheverymacOSincludes.Thepkghasitslinein`checksums.txt`likeeveryotherreleasefile,sothisonecheckcoversanarchiveandthepkgalike.Terminal,inthedownloadfolder:```shshasum-a256-c--ignore-missingchecksums.txt```Youshouldsee:Thecommandexitswithstatus0andprints`OK`besideeachfileyoudownloaded.###OnWindowsThesamecheckrunsinPowerShell,with`cosign`forWindowsonyourPATH.PowerShellcontinuesalinewithabacktick,andithasno`sha256sum`,sothelastthreelinescomparethehashthemselves.Putyourarchive'snamein`$zip`.PowerShell,inthedownloadfolder:```powershellcosignverify-blob--signaturechecksums.txt.sig--certificatechecksums.txt.pem`--certificate-identity-regexp'^https://github\.com/Strazahq/straza/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$'`--certificate-oidc-issuerhttps://token.actions.githubusercontent.comchecksums.txt$zip="straza_2.0.1_windows_amd64.zip"$line=Select-String-Pathchecksums.txt-Pattern(''+[regex]::Escape($zip)+'$')(Get-FileHash-AlgorithmSHA256$zip).Hash-eq($line.Line-split'\s+')[0]```Youshouldsee:`cosign`reportsthesignatureasverified,andthelastlineprints`True`.TheMSIforaWindowsmachinewhoseagentsyougoverngetsthesamehashcheckin[itsownstep](#install-the-service-on-windows).TheWindowsstepsonthispagefollowthereleaseconfigurationandwerenotwalkedonaWindowsmachine.>Actnow:Amismatchmeansadifferentfile>>Anyfailedcheckmeansthefileisnottheonethereleasejobbuilt.Deleteitandreportitthroughthechannelonthe[Security](https://docs.straza.ai/security/index.md)pages.##InstallthepackageonLinuxOnaLinuxmachinewhoseagentsyougovern,installthe`straza`packageinplaceofthe`straza`binaryfromthearchive.Itholdsonlytheclientanditsbackgroundservice,so`strazad`and`strazactl`stillcomefromthearchive.Othermachinesskipthisstep.Installthepackageyouverifiedasroot,fromthedownloadfolder,with`apt`onDebianandUbuntuor`dnf`onRHELandRockyLinux.Onanarm64machine,write`arm64`inplaceof`amd64`.Terminal,DebianorUbuntu,inthedownloadfolder:```shsudoaptinstall./straza_*_linux_amd64.deb```Terminal,RHELorRockyLinux,inthedownloadfolder:```shsudodnfinstall./straza_*_linux_amd64.rpm```Youshouldsee:Thepackagemanagerreports`straza`installed,and`systemctlis-activestraza-service.socket`thenprints`active`.Thepackageinstalls`/usr/bin/straza`,theunits`straza-service.socket`and`straza-service.service`,andthestraza-serviceOSaccount,anditenablesthesocket.systemdstarts`strazaservice`underthataccountatthefirstconnection,withthehardeningitsunitsets,itssocketat`/run/straza-service/service.sock`anditsstatein`/var/lib/straza-service`.Nopackagescriptwiresaharnessorenrollsanyone.[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-machine-with-the-straza-package)goesonfromhere,withthemanagedinstallanadministratorrunsandthe`strazaenroll`eachpersonruns.ThepackagescarrynoOpenPGPsignature,andnoaptordnfrepositoryservesthemyet,sothechecksumcheckofthestepbeforeiswhatshowsthatthefilecamefromthereleasejob.The[roadmap](https://docs.straza.ai/project/roadmap/index.md#the-background-service-on-each-system)liststherepositoriesasplanned.##PutthebinariesonyourpathExtractthearchiveandcopythethreebinariesintoadirectoryonyourPATH,suchas`/usr/local/bin`onLinuxandmacOS.OnaLinuxmachinewiththe`straza`package,copyonly`strazad`and`strazactl`.Thepackage's`/usr/bin/straza`thenstaystheonly`straza`there.OnaMacwiththeStrazapackageformacOS,copyonlythosetwoaswell,because`/usr/local/bin/straza`isthepackage'slinktoits`/opt/straza/bin/straza`,andacopyontothatlinkwouldoverwritethepackage'sbinary.###OnWindowsInthesamePowerShellwindow,whichstillholds`$zip`,extractthezipintoafolderofyourown.ThecommandsaddthatfoldertoyouruserPathandtothePathofthecurrentwindow.NewPowerShellwindowsreadtheuserPathwhentheystart.PowerShell,inthedownloadfolder:```powershell$dir="$env:LOCALAPPDATA\Programs\straza"Expand-Archive-Path$zip-DestinationPath$dir[Environment]::SetEnvironmentVariable("Path",[Environment]::GetEnvironmentVariable("Path","User")+";$dir","User")$env:Path+=";$dir"```Youshouldsee:`strazad.exe`,`strazactl.exe`and`straza.exe`inthefolder.Youtypethemwithout`.exe`.##InstalltheserviceonWindowsOnaWindowsmachinewhoseagentsyougovern,anadministratorinstalls`strazaservice`fromtheStrazaMSI,whichinstallsonamd64only.RunthecommandsofthisstepinaPowerShellstartedwithRunasadministrator,inthedownloadfolder.Othermachinesskipthisstep.[DeploywithIntune](https://docs.straza.ai/guides/govern-an-agent/deploy-with-intune/index.md)installsthesameMSIonafleet.TheservicerunsunderitsownOSaccount,thevirtualaccountNTSERVICE\straza-service,whichWindowscreateswiththeserviceandmanageswithoutapassword.Clientsreachitonthenamedpipe`\\.\pipe\straza-service`.Itkeepsthekeys,thesessionsandtheauditspoolin`C:\ProgramData\straza-service`,whichonlytheservice,SYSTEMandAdministratorscanopen.TheMSIcarriesnoAuthenticodesignatureyet,sofirstcheckitshashagainstthechecksumsfilewhosesignatureyouverified.PowerShell,asanadministrator,inthedownloadfolder:```powershell$msi=(Get-Item.\straza_*_windows_amd64.msi).FullName$line=Select-String-Pathchecksums.txt-Pattern(''+[regex]::Escape((Split-Path$msi-Leaf))+'$')(Get-FileHash-AlgorithmSHA256$msi).Hash-eq($line.Line-split'\s+')[0]```Youshouldsee:`True`.Theninstallit.`Start-Process`waitsfortheinstallerandreturnsitsexitcode,whichabare`msiexec`callinPowerShelldoesnot,andtheinstallerwritesitslogto`straza-msi.log`inyourtemporaryfolder.PowerShell,asanadministrator,inthedownloadfolder:```powershell(Start-Processmsiexec.exe-Wait-PassThru-ArgumentList"/i`"$msi`"/qn/l*v`"$env:TEMP\straza-msi.log`"").ExitCode```Youshouldsee:`0`,and`Get-Servicestraza-service`thenshowsthestatus`Running`.TheMSIputs`straza.exe`in`C:\ProgramData\straza\bin`andlocks`C:\ProgramData\straza`sothatonlyadministratorscanchangeit.Beside`straza.exe`itputs`git-remote-straza.exe`,asecondcopyofitthatgitrunsfor[GitthroughStraza](https://docs.straza.ai/guides/serve-mcp-apps/git-through-straza/index.md),anditadds`C:\ProgramData\straza\bin`tothemachinePATH,sothatgitfindsthehelperinprocessesstartedafterthenextsign-in.ItregisterstheserviceunderitsownOSaccount,withasecurityidentifierofitsownandarestartaftereachfailure,registersitssourceintheApplicationeventlogandstartsit.Theservicereports`Running`onlyonceitspipelistens,soastartthatcannottakethepipeshowsasafailedstart.Atitsfirststarttheservicecreates`C:\ProgramData\straza-service`foritself.Anexitcodeof`3010`alsomeanssuccess,andarestartthenfinishesremovinganoldfilethatwasinuse.Ifthisfails:Anexitcodeof`1603`,andanErroreventintheApplicationeventlogunderthesourcestraza-servicewhosetextholds`TheStrazaMSIcouldnotlockC:\ProgramData\strazatoadministrators,soWindowsundidtheinstall.`:Therestofthattextsayswhy.Mostoftenanaccountotherthananadministratorcreated`C:\ProgramData\straza`first,whichanyusermaydounder`C:\ProgramData`,andtheMSIdoesnottakeoverafolderanotheraccountowns.Movethatfolderaway,theninstalltheMSIagain.`AnewerversionofStrazaisalreadyinstalled.Uninstallitfirstifyouneedthisolderversion.`in`straza-msi.log`:ThisMSIisolderthantheoneonthemachine,andtheMSIrefusesadowngrade.Keepthenewerone,oruninstallitfirstas[Undo](#undo)shows.ThenrunthemanagedinstallwiththeMSI's`straza.exe`.ItpinsyourStrazaserverforeveryuserofthemachineandwirestheharness'shookstothatbinary.Use`codex`or`gemini`forthoseharnesses,andyourownserver'saddressinplaceoftheexample.PowerShell,asanadministrator:```powershellC:\ProgramData\straza\bin\straza.exeinstall--managed--serverhttps://straza.example.comclaude-code```Youshouldsee:A`managedconfig`linethatnames`C:\ProgramData\straza\config.yaml`,a`managedbinary`linethatnames`C:\ProgramData\straza\bin\straza.exe`,andthe`managedwiring`and`managedmcp`linesoftheharness.ThemanagedinstallnevercopiesabinaryonWindows,soitrunsonlywheretheMSIinstalled`straza.exe`.[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-windows-machine)goesonfromherewiththe`strazaenroll`eachpersonruns.Ifthisfails:```strazainstall--managed`foundnoC:\ProgramData\straza\bin\straza.exe,whichtheStrazaMSIinstalls.InstalltheStrazaMSIforWindowsfirst,thenrunthiscommandagain.``:TheMSIisnotinstalledonthismachine.Installitasthestepaboveshows,thenrunthemanagedinstallagain.Amessagethatstarts```strazainstall--managed`couldnotlockC:\ProgramData\strazatoadministrators``:ThePowerShellwindowdoesnotrunasadministrator.StartonewithRunasadministrator,thenrunthemanagedinstallagain.Whena`straza`commandsaysthatthebackgroundserviceisn'trunning,checktheserviceinanelevatedPowerShell.`Get-Servicestraza-service`showswhetheritruns,andtheApplicationeventlogunderthesourcestraza-serviceshowswhyitstopped.PowerShell,asanadministrator:```powershellGet-Servicestraza-serviceGet-EventLog-LogNameApplication-Sourcestraza-service-Newest10|Format-ListTimeGenerated,EntryType,Message```Youshouldsee:`Running`inthestatuscolumn,anda`msg="strazaservicelistening"`lineamongthenewesteventswithnoErrorentryafterit.AstarttheservicerefusesendsinanErroreventwith`msg="strazaservicestopped"`andthereason.`Start-Service`thenreportsthatthestartfailed,andWindowstriesagainafter5seconds,5secondsandaminute.Whenaccountsotherthanadministratorscanchange`C:\ProgramData\straza`,theservicestillstarts,anditwritesaWarningeventwith`msg="themanagedconfigisnotused"`andthereason.`strazadoctor`,runbytheperson,checkstherestofthemachine,andits`managedlayout`linefailsinthatcasetoo.Ifthisfails:Arefusalthatnames`C:\ProgramData\straza-service`withtheaccountitbelongsto,andends`Anadministratormustmovethatfolderaway,thenstarttheserviceagain.`:Anotheraccountcreatedthefolderbeforetheservice'sfirststart,oritsaccessrulesletotheraccountsin.Movethefolderaway,thenrun`Start-Servicestraza-service`.Amessagethatstarts```strazaservice`couldnotcreateitspipe\\.\pipe\straza-service,becauseanotherprogramalreadyholdsthatname``:Anotherprogramcreatedapipeofthatnamebeforetheservicestarted.Restartthecomputer,orfindandstopthatprogram,thenstarttheserviceagain.Amessagethatstarts```strazaservice`couldnotreadthiscomputer'sMachineGuid``:TheservicebindseachkeytotheMachineGuidvalueunder`HKLM\SOFTWARE\Microsoft\Cryptography`anddoesnotstartwithoutit.Checkthatthevalueexists,thenstarttheserviceagain.```strazaservice`runsastheWindowsservicestraza-serviceandcannotrunfromaconsole.StartitfromanadministratorPowerShellwith`Start-Servicestraza-service`.``:Someoneran`strazaservice`inaterminal.OnWindowsitrunsonlywhentheServiceControlManagerstartsit.``StrazadoesnottrustC:\ProgramData\straza,becauseaccountsotherthanadministratorscanchangeit.Anadministratormustrun`strazainstall--managed`again,whichlocksthefolder.``:The`managedlayout`lineof`strazadoctor`,andthereasonoftheservice's`themanagedconfigisnotused`event.AnearlierStraza,oranotherprogram,leftthefolderopentootheraccounts.Runthemanagedinstallagainasanadministrator.Untilthen,Strazatreatsthemachineasonewithoutamanagedinstall,sotheserviceusestheserverandkeysofeachenrollment.##InstalltheserviceonmacOSOnaMacwhoseagentsyougovern,anadministratorinstalls`strazaservice`fromtheStrazapackageformacOS,thepkgthatreleasesfrom2.0.0carry,downloadedandverifiedin[thefirststep](#download-a-release-and-verify-it).OnatestMac,orwhennoreleaseyoucanusecarriesthepkg,[buildthepackagefromsource](#build-the-package-from-source)firstandinstallthatone.Othermachinesskipthisstep.[DeploywithIntune](https://docs.straza.ai/guides/govern-an-agent/deploy-with-intune/index.md#deploy-to-macos)and[DeploywithJamfPro](https://docs.straza.ai/guides/govern-an-agent/deploy-with-jamf/index.md)installthesamepkgonafleet.Theservicerunsasthelaunchddaemonai.straza.serviceunderitsownOSaccount,thehiddenaccount_straza-service,whichthepackagecreateswithafreeuserIDfrom450to499.Clientsreachitonthesocket`/opt/straza/run/service.sock`,wheremacOStellstheservicetheaccountofeachcaller.Itkeepsthekeysandsessionsin`/var/db/straza-service`,whichonlythataccountcanopen,andTimeMachineleavesthatfolderoutofitsbackups.ThereleasejobsignsthepkganditsbinarywiththeDeveloperIDofSynapTechs.r.o.,thecompanythatpublishesStraza,andApplenotarizesthepkg,somacOSinstallsitwithoutawarning.Yourchecksumcheckofthefirststepalreadyproveswherethefilecamefrom.ToseewhatmacOSchecksaswell,askitbeforeyouinstall,inthedownloadfolder.Terminal,ontheMac,inthedownloadfolder,optional:```shpkgutil--check-signaturestraza_*_darwin_universal.pkgspctl-a-vvv-tinstallstraza_*_darwin_universal.pkg```Youshouldsee:From`pkgutil`,thelines`Status:signedbyadevelopercertificateissuedbyApplefordistribution`and`Notarization:trustedbytheApplenotaryservice`,alinethatstarts`Signedwithatrustedtimestampon`,and`DeveloperIDInstaller:SynapTechs.r.o.(WMPWM57KYK)`asthefirstcertificateofthechain.From`spctl`,thefilenamefollowedby`accepted`,then`source=NotarizedDeveloperID`and`origin=DeveloperIDInstaller:SynapTechs.r.o.(WMPWM57KYK)`.Ifthisfails:`spctl`prints`rejected`,or`pkgutil`namesanothercertificateornonotarization:Thefileisnotthepkgthatthereleasejobsigned,orApplenolongertrustsitssignature.Donotinstallit.Deleteitandreportitthroughthechannelonthe[Security](https://docs.straza.ai/security/index.md)pages.ApackageyoubuiltfromsourcewithoutyourownDeveloperIDfailsbothchecks,aseveryunsignedpackagedoes.Theninstallthepkg.Terminal,asanadministrator,inthedownloadfolder:```shsudoinstaller-pkgstraza_*_darwin_universal.pkg-target/```Youshouldsee:`installer:Theinstallwassuccessful.`,and`sudolaunchctlprintsystem/ai.straza.service`thenshows`state=running`.Beforeanyfilelands,thepackagerefusestoinstallwhileaccountsotherthanrootcanchange`/opt`,`/opt/straza`or`/opt/straza/bin`,becausethehooksrunthebinarythere.Itthenputs`straza`in`/opt/straza/bin`,links`/usr/local/bin/straza`and`/usr/local/bin/git-remote-straza`toit,andinstallsthedaemonas`/Library/LaunchDaemons/ai.straza.service.plist`.gitrunsthesecondlinkfor[GitthroughStraza](https://docs.straza.ai/guides/serve-mcp-apps/git-through-straza/index.md).Thepackagecreates`/var/db/straza-service`andthesocketfolder`/opt/straza/run`fortheservice'saccountandstartstheservice.Fromthenonlaunchdstartsitateveryboot,beforeanyonesignsin,andrestartsitwhenitstops.Theservicewritesitslogto`/var/log/straza-service/service.log`.Aservicethatanadministratordisabledbeforetheinstallstaysdisabled.SystemSettingsliststheserviceunderLoginItems&Extensionsbytheorganizationinitssigningcertificate,whichisSynapTechs.r.o.forthereleasepkg.Ifthisfails:`installer`reportsthattheinstallfailed,and`/var/log/install.log`holdsalinethatstarts`Strazawasnotinstalled,because`:Thepackagestoppedbeforeanyfilelanded.Therestofthelinenamesthecauseandwhatanadministratorchanges:afolderonthebinary'spaththatotheraccountscanchange,anexisting_straza-serviceaccountthatisnothiddenorhasaloginshell,ornofreeuserIDfrom450to499.AStrazaservicethatalreadyrankeepsrunning.Alinein`/var/log/install.log`thatstarts`Strazainstalleditsfiles`:Thefileslanded,buttheservicedidnotstart,andtherestofthelinesayswhy,suchasastateorsocketfolderthatbelongstoanotheraccount.Dowhatitsays,theninstallthepackageagain.Thenrunthemanagedinstallwiththepackage'sbinary.ItpinsyourStrazaserverforeveryuseroftheMacandwirestheharness'shooksto`/opt/straza/bin/straza`.Runitbythatfullpath,becauseonsomeMacsapersonowns`/usr/local/bin`,wherethepackage'slinkssit.Use`codex`or`gemini`forthoseharnesses,andyourownserver'saddressinplaceoftheexample.Terminal,asanadministrator:```shsudo/opt/straza/bin/strazainstall--managed--serverhttps://straza.example.comclaude-code```Youshouldsee:A`managedconfig`linethatnames`/etc/straza/config.yaml`,a`managedbinary`linethatnames`/opt/straza/bin/straza`,andthe`managedwiring`and`managedmcp`linesoftheharness.ThemanagedinstallnevercopiesabinaryonmacOS,soitrunsonlywherethepackageinstalled`/opt/straza/bin/straza`.Adevicemanagementtoolthatrunsitasroot,outsidesudo,skipseachperson'scodexMCPregistrationandsaysso,andthemanagedcodexhooksstillgoverneverycodextoolcall.[Enrollamachine](https://docs.straza.ai/guides/govern-an-agent/enroll-a-machine/index.md#a-macos-machine)goesonfromherewiththe`strazaenroll`eachpersonruns.Ifthisfails:```strazainstall--managed`foundno/opt/straza/bin/straza,whichtheStrazapackageformacOSinstalls.InstalltheStrazapackagefirst,thenrunthiscommandagain.``:ThepackageisnotinstalledonthisMac.Installitasthestepaboveshows,thenrunthemanagedinstallagain.Whena`straza`commandsaysthatthebackgroundserviceisn'trunning,checktheserviceinTerminal.`sudolaunchctlprintsystem/ai.straza.service`showswhetheritruns,and`/var/log/straza-service/service.log`showswhyitstopped.Terminal,asanadministrator:```shsudolaunchctlprintsystem/ai.straza.servicesudotail-n20/var/log/straza-service/service.log```Youshouldsee:`state=running`inthefirstoutput,anda`msg="strazaservicelistening"`lineinthelogwithnoerrorafterit.Ifthisfails:Amessagethatstarts```strazaservice`cannotuse/opt/straza/run``:Thesocketfolderthatthepackagemakesismissing,belongstoanotheraccount,orotheraccountscanchangeit.Installthepackageagain,whichmakesit,thenstarttheservicewith`sudolaunchctlkickstartsystem/ai.straza.service`.Amessagethatstarts```strazaservice`couldnotreadthisMac'shardwareUUIDfrom/usr/sbin/ioreg``:TheservicebindseachkeytotheMac'shardwareUUID,which`ioreg`reportsas`IOPlatformUUID`,anddoesnotstartwithoutit.Checkthat`/usr/sbin/ioreg-rd1-cIOPlatformExpertDevice`printsthatline,thenstarttheservicewith`sudolaunchctlkickstart-ksystem/ai.straza.service`.TheIntuneandJamfProrecipesnamedabovealsoinstallaManagedLoginItemsprofilefortheteamidentifierWMPWM57KYK,whichkeepstheserviceswitchedon.Onlyadevicemanagementtoolcaninstallthatprofile,onmacOS13orlater.Withoutit,theservicecanbeswitchedoffunderLoginItems&Extensions,andwhileitisoffeverygovernedtoolcallontheMacisrefused.ClaudeCodealsoreadsitsmanagedsettingsfromonesourceonly,andaClaudeCodeprofilefromadevicemanagementtoolcomesbeforethemanagedsettingsfile.OnaMacwithsuchaprofile,ClaudeCodeskipsthefilethatcarriesStraza'shooks,withnowarning,sokeepsuchaprofileofftheMacswhoseagentsyougovern.###BuildthepackagefromsourceOnatestMac,orwhennoreleaseyoucanusecarriesthepkg,buildthepackageonaMacfromacloneoftherepository,withGo1.26ornewer,GitandApple'sCommandLineTools.Thescriptneedsthenoticesofeverymodulethebinarylinks,sogeneratethemfirst.Itsversioncomesfrom`gitdescribe`.Terminal,onaMac,inafolderofyourown:```shgitclonehttps://github.com/strazahq/straza.gitcdstrazav=$(gitdescribe--tags|sed's/^v//')gorun./tools/notices-release-version"$v"-obuild/notices/THIRD_PARTY_NOTICES.txtshdeploy/macos/build-pkg.sh"$v"dist```Youshouldsee:Alastlinethatstarts`build-pkg.sh:wrote`andnamesthepackagein`dist`,whosenameendsin`_darwin_universal.pkg`.Thepackageholdsoneuniversal`straza`forApplesiliconandIntelMacs.Withoutthesigningvariables,thescriptsaysinonelinethatthepackageanditsbinaryareunsignedandnotnotarized,whichsuitsatestMacandnotafleet.When`STRAZA_SIGN_APP`and`STRAZA_SIGN_INSTALLER`nameDeveloperIDApplicationandDeveloperIDInstalleridentitiesofyourownintheMac'skeychain,itsignsthebinaryandthepackageasthereleasejobdoes.ItfirstchecksthateachcertificatecomesfromApple'scurrentDeveloperIDauthority,G2.Aftersigning,itchecksthatthesignedbinarydiffersfromtheunsignedonesonlybythesignature.With`STRAZA_NOTARY_PROFILE`settoanotarytoolkeychainprofileaswell,Applenotarizesthepackageandthescriptstaplesthetickettoit.Installyourpackageasthepkgabove,fromtheclone.Terminal,asanadministrator,intheclone:```shsudoinstaller-pkgdist/straza_*_darwin_universal.pkg-target/```Youshouldsee:`installer:Theinstallwassuccessful.`,and`sudolaunchctlprintsystem/ai.straza.service`thenshows`state=running`.Themanagedinstallandtheservicechecksofthisstepholdforitunchanged.AnunsignedpackageshowsinLoginItems&Extensionsas`straza`,thenameofitsbinary,inplaceofanorganization.##CheckeachbinaryAskeachbinarywhatitis.Terminal,anyfolder:```shstrazadversionstrazactlversionstrazaversion```Youshouldsee:Onelinefromeach,withitsname,itsversion,thecommititwasbuiltfrom,theGoversionandtheplatform.ThesamethreecommandsworkinPowerShell.##Buildfromsourceinstead{.nostep}YouneedGo1.26ornewer,GitandMake.Clonetherepository,changeintoit,andrunthebuildtarget.Terminal,build:```shgitclonehttps://github.com/strazahq/straza.gitcdstrazamakebuild```Thebuildprintsone`gobuild`lineperbinaryandwritesthesamethreestaticbinariesunder`bin`,stampedwiththeversionthat`gitdescribe`reportsforyourcheckout.Thefirstbuilddownloadsandcompileseverydependency,soittakeslongerthanthebuildsafterit.Addtherepository's`bin`directorytothePATHofthecurrentPOSIXshellandaskeachbinarywhatitis.Terminal,build:```shexportPATH="$PWD/bin:$PATH"strazadversionstrazactlversionstrazaversion```Youshouldsee:Onelineeach,suchas`strazadv1.1.0-117-g106081a8(commit106081a8,go1.26.6,linux/amd64)`.Keepthisterminalopenforthetutorial.AnewterminalneedsthesamePATHsetting,unlessyoucopythebinariesintoadirectoryalreadyonthePATH.##Choosehowtoruntheserver{.nostep}Theserveralsoshipsasthecontainerimage`ghcr.io/strazahq/straza`,signedwithkeylesscosignlikethechecksumsfile,andasaHelmchartunder`deploy/helm/straza`forKubernetes.Eachwayofrunningithasitsownpage.Thescalecolumncomesfrom[Requirementsandsizing](https://docs.straza.ai/reference/requirements-and-sizing/index.md).|Path|Profile|Scale|Chooseitwhen||---|---|---|---||[Thereleasearchiveononehost](https://docs.straza.ai/guides/operate/standalone-host/index.md)|Standalone|Onehost.Arunheld1,000connectedagentsin2coresand1GB.|Youwantonebinaryandonedatadirectory,withnothingelsetoinstall.||[Abuildfromsource](#build-from-source-instead)|Either|Thesameasthereleasearchive|Youneedacommitthathasnoreleaseyet,oryoubuildyourownbinaries.||[ThecontainerimagewithDocker](https://docs.straza.ai/guides/operate/docker/index.md)|Standalone,orenterprisewiththerepository'scomposefile|Onehost|Yourunyourservicesascontainers.||[Theenterpriseshape](https://docs.straza.ai/guides/operate/enterprise-shape/index.md)|Enterprise|Replicasbehindoneloadbalancer,sharingonePostgresandoneNATS|Yousignpeopleinthroughyourownidentityprovider,oryouneedmorethanonereplica.||[KuberneteswithHelm](https://docs.straza.ai/guides/operate/kubernetes-with-helm/index.md)|Enterprisebydefault,orstandalonewithonereplica|Tworeplicasbydefault,withPostgresandNATSbundledoryourown|YourunKubernetes.||[Thedemostack](https://docs.straza.ai/evaluate/try-it-on-the-demo-stack/index.md)|Enterprise,withdemodefaults|Onemachinewith4coresand8GB|Youwanttotrythewholeproductononemachine,withmidPoint,KeycloakandaSIEM.|`straza`goesontothemachinesofthepeopleandagentsyougovern,and`strazactl`ontothemachinesofthepeoplewhoadministerStraza.OnaLinuxmachineyougovern,the`straza`packageinstallstheclientandruns`strazaservice`besidetheagentsunderitsownOSaccount.OnaWindowsmachinethe[StrazaMSI](#install-the-service-on-windows)doesthesame,andonaMacthe[StrazapackageformacOS](#install-the-service-on-macos).[Yourfirstgovernedsession](https://docs.straza.ai/evaluate/try-it-on-one-laptop/index.md)startstheservicebyhandinstead,asyourownuser.[RunStraza](https://docs.straza.ai/guides/operate/index.md)listseveryoperationsguide.##Undo{.nostep}Installingfromthearchivewritesnothingbeyondthebinaries,soremovingStrazafromamachinewhereitwasonlyinstalledmeansdeletingthethreefiles.OnWindows,alsotakethefolderoutofyouruserPath.TheStrazaMSIcomesoffinanelevatedPowerShellwiththeinstallcommandofitsstep,with`/x`inplaceof`/i`.Theuninstallremovesthewiringofeveryharnessthemanagedinstallwired,stopsandremovestheserviceandremoves`straza.exe`anditscopy`git-remote-straza.exe`.WiththemgoestheMSI'sPATHentry.Itkeeps`C:\ProgramData\straza-service`withthemachine'skeys,sotheMSIinstalledagainresumeseveryenrollment,unlessyouadd`PURGE=1`after`/qn`,whichdeletesthem.AmacOSpackagehasnouninstallofitsown,sotheStrazapackageformacOScomesoffwith`sudo/opt/straza/bin/strazainstalleruninstall`.Itstopstheservice,removesthewiringofClaudeCode,CodexCLIandGeminiCLIandthenthepackage'sfiles,andkeeps`/var/db/straza-service`withtheMac'skeysforareinstall,unlessyouadd`--purge`.The`straza`packagecomesoffwithitspackagemanager,and[Backupandupgrade](https://docs.straza.ai/guides/operate/backup-and-upgrade/index.md#remove-straza-from-a-client-machine)sayswhateachremovalkeepsonthemachineandwhatstaysattheserver.Once`strazadserve`hasrun,itkeepsitsstateina`data`directorywhereitwasstarted.`strazactl`keepsnothingonthemachine.Anolder`strazactl`thatsignedinlefta`credentials.json`in`.straza`underyourhomedirectory.Thatfileworksnowhereandcanbedeleted.`strazaservice`keepseachenrollmentinitsstatedirectory,whichis`service`inside`STRAZA_HOME`whenyoustartitwith`STRAZA_HOME`set,asthefirstgovernedsessiondoes.IfyouconnectedClaudeCode,run`strazauninstallclaude-code`firsttoremovethehookwiring.Stop`strazaservice`ifitruns,thenremove`data`and`.straza`foracleanmachine.[Yourfirstgovernedsession](https://docs.straza.ai/evaluate/try-it-on-one-laptop/index.md)startstheserverandtakesyoutothefirstpolicydecision.


Walked on v1.1.0-117-g106081a8 on 2026-10-06, except the build from source, and the Windows and macOS steps, which only a test script ran. An Alpine 3.20 linux/amd64 container that held only the three binaries of this build, copied into /usr/local/bin, where the three version commands ran and the state folders of the undo step were seen. The release download, the cosign check and the checksum check ran later on Linux against the published release 1.1.2 on 2026-10-14, and they run against 2.0.0 only after its tag. Every Windows step was not run, and the build from source was not run because this walk ran no git or make. The Windows service step now installs from the MSI. MSIs built from the source tree at v1.0.0-1600-g3c02a286 ran on a Windows 10 machine on 2026-10-26, by a test script and not by these steps, where the install, the uninstall, an upgrade while hooks ran, the refused downgrade and the purge passed. The service it registers ran on 2026-10-22 on a Windows 10 machine at v1.0.0-1585-gb30a22d7, installed with the managed install and the sc.exe commands of that version, and again as an upgrade to v1.0.0-1586-g3a9b10d6 while a Claude Code window stayed open. The macOS steps were written on 2026-10-26 from the package sources and the code, and the steps for the release pkg the same day from the release workflow and its scripts, before any release carried a pkg. An unsigned package built from the source tree ran in a macOS 26.6.2 virtual machine on 2026-10-26 at v1.0.0-1610-g366fac50, installed by a test script and not by these steps. On 2026-10-27 a pkg built from the source tree at v1.0.0-1615-g272946e5, signed with the Developer ID and notarized by Apple, passed spctl on a Mac, and the same test script installed, upgraded, uninstalled, installed again and purged it in a macOS 26.6.2 virtual machine.