The agent
Pure Windows PowerShell 5.1 — already on every supported machine. Runs as a SYSTEM scheduled task with a watchdog that restarts it within 5 minutes.
New · Automatic isolation of compromised PCs →
Every Windows endpoint.
Every Windows endpoint.
One calm console.
Shield360 Endpoint monitors, hardens and contains your Windows Servers and PCs from a single self‑hosted console. A lightweight PowerShell agent, Microsoft Defender as the engine, and a prevention layer that heals itself every 15 minutes.
irm https://shield360.biz/install.ps1 | iex
- 0 npm packages
- 0 extra software on endpoints
- 100% on your own server
Preview of the Shield360 console with sample data: 248 endpoints, CPU and memory charts, top hosts and open alerts.
Brute-force blocked185.220.101.42 · 47 failed RDP logons
Policy re-appliedPUAProtection restored on WS-FIN-07
Runs on what you already have
- Windows Server 2016
- 2019
- 2022
- 2025
- Windows 10
- Windows 11
- PowerShell 5.1
- Node.js 22
0s
Agent check‑in interval. Live CPU, memory, disk and AV status for every machine.
0min
Policy re‑applied automatically. Local tampering is undone before anyone notices.
0ASR
Attack surface reduction rules, each set to Block, Audit or Off per policy.
0h
Server mirror refresh of Microsoft's signed definition package for offline networks.
How it works
Three parts. No moving pieces you don't own.
An agent on each endpoint, one Node.js server with SQLite, and a browser. No cloud tenant, no per‑seat licence server, no third‑party agent to babysit.
The server
Node.js 22.13+ with built‑in SQLite. No npm packages to audit or patch. Runs on Windows Server, Windows or Linux.
The console
A fast, focused web UI served with strict security headers. Overview, endpoints, alerts, policies, definitions and audit — nothing you don't need.
Visibility
See every machine the way it really is.
Hardware, security posture, inventory and live performance — reported every minute, searchable in seconds.
Antivirus & attack prevention
Eleven layers. One policy.
Shield360 manages Microsoft Defender — built into every supported Windows version — and adds its own prevention layer on top. Configure it once under Protection policies, assign it per endpoint, and pilot safely in Report only mode.
Antivirus, centrally enforced
Real‑time, behaviour, script (AMSI), download and cloud protection. Cloud block level, PUA blocking, signature update interval, a daily quick scan and managed exclusions — all from one place.
Exploit protection
17 ASR rules — LSASS credential theft, Office macro abuse, obfuscated scripts, PsExec/WMI lateral movement, webshells, USB malware.
Ransomware
The advanced ransomware protection rule plus controlled folder access guard the files that matter.
Malicious sites & C2
Defender network protection, plus blocklisted domains via hosts file and IPs via the firewall.
Brute‑force blocking
Watches failed logons — RDP, SMB and more — and blocks the attacking IP in the firewall for a set time. Trusted IPs stay on an allowlist.
Blocklist (IOCs)
SHA‑256 hashes are killed and quarantined. IPs, CIDRs and domains are blocked. Paste whole threat feeds.
Hardening
Firewall on, inbound blocked by default. SMBv1, LLMNR and WDigest off. NLA for RDP, PowerShell logging, optional LSA protection.
Attack detection
Event‑log watch for log clearing, new accounts, privileged group changes, suspicious services, Defender being disabled and attack‑like PowerShell.
Virus definitions
Every endpoint on Microsoft's latest definitions — with a signed server mirror for networks that can't reach Microsoft.
Response actions & automatic isolation
Isolate or release, kill a process, quarantine a file, scan a path, remove threats, unblock an IP. And when an endpoint is compromised, it cuts itself off — without waiting for the server.
See isolation in action →Self‑healing by design
Every 15 minutes the agent re‑applies its policy and reports compliance for each individual setting. Someone switched off PUA protection locally? It's back on the next cycle. Settings managed by Group Policy or Intune take precedence and are reported honestly as non‑compliant.
Automatic isolation
When a PC is compromised, it quarantines itself.
The moment an enabled trigger fires, the agent isolates the endpoint on its own — so it works even while your server is down. All inbound and outbound traffic is blocked, IPv4 and IPv6, internet and LAN. Except one line: back to Shield360, so you stay in control.
- Survives restarts. Isolation stays on until an admin clicks Release isolation.
- Works without DNS. The server address is pinned in the hosts file.
- Server‑safe by default. Servers raise a critical alert instead, and you isolate with one click.
Trigger (per policy)Default
Malware Defender could not remove
Any malware detection
A blocklisted program was running
Ransomware activity blocked
Security event log cleared
Antivirus turned off
Attack‑like PowerShell executed
Servers: alert only, don't auto‑isolate
Live simulation
Network healthy
Virus definitions
The latest virus database. Everywhere.
Microsoft publishes new Defender definitions several times a day. Shield360 keeps every endpoint current in three layers — including the ones that can't reach the internet.
-
1
every 4h
Defender's own updater
Runs at the interval set in your protection policy. Default: every 4 hours.
-
2
every 15m
The agent double‑checks
Every 15 minutes. Stale definitions are updated by the agent itself. Above twice the interval it's non‑compliant; above 3 days it raises an alert.
-
3
verified twice
Signed server mirror
The server fetches Microsoft's full package (
mpam-fe.exe, ~200 MB) and keeps it only with a valid Microsoft signature. Isolated PCs and offline networks download it from you — and verify the signature again before installing.
Security design
A security tool that isn't the weakest link.
Management tools are high‑value targets. Shield360 is built so a compromised console can't be turned into a remote‑execution platform.
Per‑agent keys
Each agent gets its own random key at enrollment. The server stores only a SHA‑256 hash. Removing an endpoint revokes it instantly.
Fixed action allow‑list
Remote actions come from a fixed list. The server cannot run arbitrary scripts on your endpoints — by design.
Rotatable enrollment
The enrollment token only registers new machines. Rotate it any time without touching enrolled agents.
scrypt + lockout
Admin passwords hashed with scrypt. HttpOnly, SameSite=Strict sessions. Five failed logins lock the source IP for five minutes.
Strict headers
The console ships with CSP, frame denial and nosniff. HTTPS with your own internal CA certificate is a single command.
Locked‑down agent
Config and key live in C:\ProgramData\Shield360, readable only by SYSTEM and Administrators. Full audit log of every action.
Built‑in alert rules
Alerts that raise and resolve themselves.
Sensible rules out of the box, thresholds you can tune in config.json. When the condition clears, the alert closes on its own — no stale queue to triage on Monday.
Critical
No active antivirus · Defender real‑time off · Threat detected · Auto‑isolated
High
Endpoint offline · Firewall profile disabled · Failed‑logon spike · Pending security updates
Warning
Disk ≥ 90% · Sustained CPU ≥ 90% · Memory ≥ 90% · Outdated signatures · Workstation without BitLocker
Info
Restart pending
Deploy
From zero to protected before your coffee cools.
One command installs the server — Node.js check, verified download, HTTPS certificate and auto‑start included. Then the console hands you ready‑to‑paste agent commands with your server URL and token already filled in.
1
Install the server
2
Deploy agents your way
Paste the one‑line command from the Deploy page into an elevated prompt.
3
Watch it light up
Within a minute the machine appears under Endpoints. Assign a policy, start in Report only, then switch to Enforce.
Downloads
Everything the installer uses, for air‑gapped networks or your own review.
Server
Any Windows Server or Windows machine (Linux works too) with Node.js 22.13 or later. No npm packages.
Endpoints
Windows Server 2016 / 2019 / 2022 / 2025 or Windows 10 / 11 with built‑in Windows PowerShell 5.1.
At scale
GPO startup script out of the box. Intune, SCCM or any RMM tool can run the same command.
Roadmap
What's next.
Agent self‑update
Email, Teams & Slack notifications
Multiple admins with roles
Signed MSI agent package
Restore from quarantine
Microsoft Defender for Endpoint integration
FAQ
Questions, answered.
Still curious? The README and testing guide ship with every copy, or write to [email protected].
Do I need to replace my antivirus?
No. Shield360 uses Microsoft Defender — already built into every supported Windows version — as its engine, and manages it centrally. It also reports third‑party AV where present.
Will auto‑isolation take down my production servers?
Not by default. The "Servers: alert only" setting is on out of the box. Servers raise a critical "Compromise detected" alert and you isolate them with one click when you choose to.
What happens if my Shield360 server goes offline?
Endpoints keep enforcing their last policy and still isolate themselves when a trigger fires — the decision happens on the agent. When the server returns, everything reconciles on the next check‑in.
What does the install script actually do?
It checks for Node.js 22.13+ (installing the LTS with winget if missing), downloads the release package from shield360.biz, verifies its SHA‑256 checksum, extracts it to C:\Shield360 Endpoint, creates an HTTPS certificate and registers the server to start automatically. Upgrades keep your config and data. Read the script before you run it.
How do I pilot a policy safely?
Use Report only mode. The agent measures compliance for every setting but changes nothing, and raises alerts instead of isolating. Switch to Enforce when you're happy.
Does it work alongside Group Policy or Intune?
Yes. Settings managed by GPO or Intune take precedence, and Shield360 shows them as non‑compliant so you can see exactly where policies disagree.
Can the server run arbitrary commands on endpoints?
No. Remote actions come from a fixed allow‑list — scans, signature updates, process and connection listings, restarts with a two‑minute user warning, isolation and the response actions. Nothing else.
Take back every endpoint.
Self‑hosted. Dependency‑free. Ready in minutes.
Questions about licensing or a rollout? Email [email protected]