Windows agents extend the Artica File Server appliance to the desktop. A small agent installed on each Windows workstation gives users their personal drive, instant search over every document they are allowed to read and a continuous backup of their own folders — while the administrator keeps full control of which workstation may reach which instance, and with which rights.
This page explains the concept, the benefits and the typical use cases. To install the agent, deploy it by Group Policy and enrol your workstations, see the administration guide:
Windows agent Service, listener, MSI and Group Policy deployment, enrolment codes, Windows identities and troubleshooting.
A traditional file server is passive: workstations map drive letters, users browse folders, and the server has no idea which computer is asking. With Windows agents, each workstation becomes a known, authenticated member of an instance.
The model rests on three ideas:
The workstation is identified by a certificate, not by a password. The appliance runs its own certificate authority. Each workstation is enrolled once, with a one-time code minted by the administrator, and receives its own certificate. From then on it talks to the appliance over a mutually authenticated TLS 1.3 channel, and the certificate is renewed silently before it expires.
The workstation is pinned to one appliance. The agent trusts the certificate authority of your appliance only. An enrolment code coming from another appliance, or a server impersonating yours, is refused.
The server decides, the workstation asks. A certificate identifies a computer, not a person. What a workstation may search is decided by the administrator, who binds it to a server account; every permission is checked on the appliance, against the live file system. Nothing the workstation claims about itself grants it a right.
Enrolment is done per instance: a workstation belongs to one file-server instance and only ever sees the documents of that instance. The isolation between instances extends to the desktop.
Personal drive, created and mapped automatically With personal spaces enabled on the instance, the first connection creates the user's home directory on the appliance and maps it as a drive letter. No logon script, no per-user configuration.
"Search…" from the notification-area icon Word-start search with suggestions over the document index of the instance: file contents, OCR of scanned documents, archived mail. A result opens directly in its application or in Explorer.
Search from the web browser An @artica search keyword in the browser address bar, served by a local gateway on the workstation. The appliance's console is never exposed to the users.
Continuous backup of Documents, Pictures and Music Modified files are sent to the personal space as they change. Users can add their own folders, pause and resume the synchronisation, and see its state and any conflict in a dedicated window.
Ransomware brake When an abnormal number of known files are rewritten or change extension in a few minutes, the backup pauses automatically instead of replicating the damage onto the server.
In the user's language The agent speaks the display language of Windows, in the eight languages of the Artica console, with no setting to choose.
Mass deployment One MSI package, installed by hand, silently or by Group Policy. A transform carries only public values (the appliance address and its CA fingerprint): no secret ever sits on a deployment share.
One-time enrolment codes Valid for one workstation, for a limited time, and cancellable before use.
Workstations inventory Per instance: bound account, last contact, agent version and certificate expiry.
Immediate revocation A stolen laptop or a departed employee's computer is cut off at once, including its connections already open.
Synchronisation policy per instance Switch the workstation backup on or off for a whole instance, and exclude file patterns.
Windows identities, under a retention policy The console shows which server account each Windows user resolved to, from which workstation and when; the rows expire after a delay you choose, as personal data should.
Browse folders, or run Windows Search across the network
Ask the appliance's index: instant, even over a slow link
Search and permissions
Depends on each client's cache
Re-checked on the server, live, for every result
Home directories
Created by hand or by script
Created and mapped on first connection
Laptop documents
Lost with the laptop
Backed up continuously to the appliance
Knowing which computers connect
IP addresses in a log
An inventory of enrolled workstations
Lost or stolen computer
Change passwords and hope
Revoke it in one click
Search that costs nothing on the network. The workstation never crawls the shares: it sends a query and receives a result list of a few kilobytes.
No confidentiality trade-off. A user never sees the name, excerpt or even the count of a document they cannot open, because the check happens on the server, at the moment of the search.
No password to distribute. The workstation authenticates with its certificate, the drive is mapped with the user's own session, and the SMB password stays in the user's Windows credential vault.
Only changes travel. The backup follows file changes as they happen instead of copying whole folders on a schedule; A laptop that barely changes costs almost nothing.
Deploy once, forget. Certificates renew themselves; upgrading the agent keeps the enrolment. No workstation has to be touched again after it is enrolled.
The backup engine takes over. Once on the appliance, users' files are protected by the same encrypted, verifiable snapshots as the rest of your data.
Replacing a Windows file server Users keep their drive letter and gain a search engine over every share they are entitled to. They no longer need to know in which folder a colleague stored a document: they type two words in the icon or in the browser.
Home directories for every employee Enable personal spaces on the instance and push the agent by Group Policy: Each user gets a personal drive at first logon, without any account-by-account preparation.
Protecting laptop and remote-worker documents Documents, Pictures and Music follow the user to the appliance continuously. A broken, lost or stolen laptop no longer means lost work, and the ransomware brake keeps an infected workstation from overwriting its good copies.
Several populations on one appliance Each instance enrols its own workstations. The accounting department's computers search the accounting instance, a subsidiary's computers search their own instance On the same hardware, without ever seeing each other's documents.
Offices without a Windows domain The agent works just as well with a standalone or OpenLDAP instance: Certificate enrolment and account binding replace the trust relationship that a domain would otherwise provide.
Lost or stolen workstation, departed employee Revoke the workstation from the Workstations list of its instance: it can no longer search or reach the appliance, whatever it still holds in memory. Its user's data stays safe on the server.
Compliance and audits You can show which computers may reach your file servers, which account each one searches as, and prove that search never discloses a document beyond the file permissions With personal data kept only as long as your retention policy allows.
Windows agent Administration guide: start the service, deploy the MSI, enrol a workstation.