What the host installer changes
Every service, folder, firewall rule and policy Billet Host's installer touches, for change records and security review.
- For
- Administrators
- Applies to
- Billet 1.0
- Updated
Billet Host's installer does these things in order. If a step fails, it stops before changing anything the step did not need.
1. The data folder
It creates %ProgramData%\Billet if needed and sets its permissions to:
- SYSTEM and Administrators: full control
- Users: read
It refuses to continue if that folder is a link to somewhere else, because a SYSTEM service writes there.
2. The Billet Stats Agent, and enrollment
It installs the Billet Stats Agent by running that agent's own installer. The stats agent reports the machine's health and capabilities to the portal and keeps the machine's credential current. If the machine is not enrolled yet, this is the step that enrolls it, and a refused token stops Setup here.
The credential is kept in %ProgramData%\Billet\agent-credential.json.
3. Anything that runs a host agent already
It stops the Billet host agent service if one exists, and removes the scheduled tasks that older Billet setups used. Two host agents on one machine compete for the screen and one of them captures nothing.
4. The program
It copies billet-host-agent.exe to %ProgramFiles%\Billet.
5. Permissions on the key folder and logs
It resets %ProgramData%\Billet\tls-portal (which holds the host's private key) and %ProgramData%\Billet\logs to the data folder's permissions, removing any grant an older setup gave to a signed-in user.
6. The service and the firewall rule
| Service name | billet-host-agent |
| Display name | Billet host agent |
| Runs as | LocalSystem |
| Starts | Automatically, at boot |
| On failure | Restarts after 5 seconds, then 15 seconds, then 60 seconds |
| Firewall rule | Billet host media (UDP 4455): inbound UDP 4455, for billet-host-agent.exe only. Used by direct connections. Relayed sessions need no inbound rule. |
The service runs its worker inside the console session and follows whichever desktop is in front, which is how a person can connect at the Windows sign-in screen, the lock screen and permission prompts.
Ctrl+Alt+Del policy
Windows only accepts a Ctrl+Alt+Del from a service when the SoftwareSASGeneration policy allows it. If it does not already allow services, Setup sets:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
SoftwareSASGeneration = 1 (DWORD)It is left alone when it is already 1 or 3, and it is not removed at uninstall, because something else may have set it first. Where Group Policy sets this value, Group Policy wins.
What uninstalling removes
Uninstalling Billet Host removes the billet-host-agent service and its firewall rule. It leaves:
- the Billet Stats Agent, which has its own entry in Installed apps, and
%ProgramData%\Billet, including the credential. The credential is the machine's identity: keeping it means a reinstall is the same desktop, not a new one.