Set up Windows monitoring

What you need

• A Windows 10 or Windows 11 computer with internet access.
• An administrator account on that computer (the account that can install programs).
• An Ojava login with the Owner or Admin role.
• Before you install: tell the people who use the PC what is monitored and why (Terms §7A). Template: ojava.ch/en/employee-notice, also under Settings → Security.

Step 1: request early access (account owner)

1. Sign in to Ojava and open Devices (or the start page if you have not connected Microsoft 365), then click Request early access and say how many PCs you have.
2. We approve your request and email you the steps; from then on Devices shows Add a Windows PC with the download. If you like, we go through the next steps with you (there is a booking link on the page). Nothing is charged for PCs during early access.

Step 2: connect a PC in Ojava

1. Open Devices in the left menu and click Add a Windows PC.
2. Type the PC’s name (for example "Reception PC") and, if you like, the email of the person who uses it. Click to confirm.
3. Click Download the setup for this PC. The button gives a link that works once, for 2 minutes; the page also shows the version and the SHA-256 checksum, to check the file with Get-FileHash if you wish. The file name starts with OjavaAgentSetup and ends with 8 characters: that is this PC’s one-time code, so there is nothing to type later. The file works once and for 24 hours; if it has expired, the setup says so and changes nothing: download a new one. Repeat for each PC (one file per PC).
4. Copy the file to the PC (USB stick, shared folder, or an e-mail to yourself). Use it within 24 hours; if it is older, download it again.

Step 3: install on the PC

1. On the PC, open the file you downloaded for it.
2. Because the installer is not signed yet, Windows shows a blue window "Windows protected your PC". Click More info, check the file name starts with OjavaAgentSetup, then click Run anyway. This message disappears once the signed version of the agent arrives.
3. Windows then asks "Do you want to allow this app to make changes to your device?" and shows the publisher as Unknown. That is expected during early access: click Yes.
4. Wait for the message that the installation is complete, then close the window. Nothing else to do: the agent starts by itself whenever the PC starts.
5. Only if the window asks for a code: type the 8 characters shown in Ojava next to the PC (two groups of 4, for example K7P2-9QXM; the dash is optional). To paste instead, right-click in the window.

Step 4: check it works

1. Within 5 minutes the PC appears in Devices as Online, with the status of Windows Defender and the Windows Firewall.
2. Repeat steps 3 and 4 for each further PC. Devices shows how many PCs you use and how many are left.

If a setup is not finished

A PC you enrolled but never installed shows "Waiting for the first connection" in Devices. It does not count as a paid PC after 7 days and is then removed automatically.

Updating the agent

When a new version of the agent is available, Devices marks each PC that needs it with Update available, and owners and admins receive one email about it, with the steps. Click Download the update for this PC, copy the file to the PC and open it as an administrator: it updates the agent in place. The PC keeps its connection, its settings and its place in Devices; no new code is needed. An older setup never replaces a newer agent.

What Ojava watches for

Ojava detects and alerts. It does not block or delete anything on your PCs; the only changes it makes are switching on Windows’ own security logging and placing a few hidden decoy files (see below). When something looks wrong you receive an alert that explains what happened and what a person should check or do to fix it. Ojava looks for signs such as:

• Many files changed or deleted in a short time (a typical sign of ransomware).
• Windows Defender or the firewall switched off, or the security log cleared.
• Known attack and password-stealing tools, and attempts to read Windows passwords from memory.
• Suspicious PowerShell commands, new programs set to start automatically, new services and scheduled tasks.
• Repeated failed sign-ins on the PC, and USB storage being plugged in.
• Links between a PC alert and a Microsoft 365 alert for the same person (for example a stolen password used from abroad, then unusual activity on their PC).

What the agent reads, and what it does not

The agent reads Windows security events, the names and command lines of running programs, for files changed in user folders only the folder type and file extension (one example path when many change at once), with the user folder shown as %USERPROFILE%, the addresses of network connections, programs set to start automatically and the Windows security settings. It does not read the content of documents or emails, browsing history, keystrokes or the screen. During installation it switches on Windows' own logging of newly started programs and scheduled tasks, so that short commands can be seen, and of which program writes, renames or deletes files in the watched user folders (Desktop, Documents, Downloads; never their content), makes the Windows security log larger so these records are kept long enough, and it places a few hidden decoy files (see below); it changes nothing else. Tell your employees that their work PCs are monitored for security; in some countries this is required before you start.

Decoy files

The agent places two small hidden decoy documents (~ojava-check-1.docx and ~ojava-check-2.xlsx) in each user’s main folder (C:\Users\name), in Public Documents, and in Documents only when that folder is not synced with OneDrive, so they never appear in your cloud storage. Nobody needs to open them, and they contain no data. Ransomware changes every document it finds: if anything other than the agent changes or renames one, you get a critical alert at once. If one is deleted you get a normal alert and the agent puts it back. Programs that only read files, such as OneDrive, antivirus scans and Windows Search, do not trigger anything. Uninstalling the agent deletes them.

Removing a PC

1. In Ojava, open Devices, click the PC, then Remove device. From that moment the PC no longer counts as a paid PC, and the Ojava agent on it removes itself (its files and its Windows service, nothing else) the next time it contacts Ojava.
2. You can also remove it yourself on the PC: run the same installer file again (OjavaAgentSetup followed by the PC’s code, .exe) and choose Uninstall.
3. If Windows monitoring stops (for example the subscription ends or a payment is late), the agent stops collecting and waits. It resumes by itself if monitoring starts again. If the account is deleted, the agent removes itself from every PC.

What your employees should know

• Ojava watches the PC for signs of an attack: programs that start, files changed in bulk, Windows protection being switched off. It does not read documents, emails, browsing history or keystrokes, and takes no screenshots.
• Ojava does not block, delete or change anything. The only changes on the PC: the agent turns on Windows’ own security logging (new programs, scheduled tasks and which program changes files in the user folders; the security log is made larger) and places a few hidden decoy files that nobody needs to open. Uninstalling puts these settings back as they were.
• Tell your team before you install it (in many places this is required): what is watched, why, and who sees the alerts.

PCs managed by an IT provider, or with another antivirus

• Ojava works next to Microsoft Defender or another antivirus; it does not replace it. If your antivirus quarantines the installer (it is not code-signed yet), ask whoever manages it to allow the file OjavaAgentSetup… from ojava.ch, or send us the antivirus name.
• PCs managed by an IT provider (Intune, group policies): the installer needs a local administrator. Ask your IT provider not to switch Windows’ security logging off again: without it, Ojava sees fewer warning signs.
• The PC needs to reach https://api.ojava.ch (port 443). A company proxy or firewall that blocks it keeps the PC “Waiting”.

Need help?

Write to support@ojava.ch. If you prefer that a technician installs the agent with you, click Ask for a technician in Devices: we reply with a price and a date before anything is booked.