Install the Local Agent

Your SQL Server lives in a private network. No public endpoint, no firewall exception, and the one-shot CLI works but you’re running it several times a day. That’s the Local Agent’s job: a small Windows service inside your network that picks up verify, discovery, and import work from DeltaVault and runs it locally. It only ever makes outbound HTTPS calls: you don’t open a single inbound port.

If you are not an administrator

Pairing a Local Agent requires the administrator role, and without it the Local Agents entry does not appear under Toolkit at all. If you browse straight to the page anyway, you see an explanatory page instead of the pairing dialog: it describes what a Local Agent is and explains that pairing needs an administrator, plus an Install a Local Agent button that links back to this guide. Pass this guide along to whoever holds that role, or ask them to open Add agent and follow the steps below.

Install and pair

In DeltaVault, go to Toolkit → Local Agents and click Add agent. The dialog shows two numbered steps, “Install the agent on that machine.” and “When the installer asks, paste this endpoint and code.”, followed by a pairing code (valid for 15 minutes), your endpoint, and download links. Leave the dialog open: below the downloads, a live status starts as “Waiting for the agent to pair…” with a spinner, and there is no need to refresh or switch screens to see it update.
Download the Windows installer: deltavault-agent-x64.msi, signed by DELTAVAULT PTY LTD, so SmartScreen lets it through without a warning. Install it on a machine that can reach your database. The installer registers and starts the DeltaVault Local Agent Windows service.
The service starts and stays running. That’s expected: it idles until you pair it, rather than exiting.
Open PowerShell as Administrator and run the pairing command:
Terminal window
```
& "C:\Program Files\DeltaVault\Agent\deltavault-agent.exe" pair
```
Paste the endpoint and pairing code from the dialog when prompted. Watch the dialog: the moment this succeeds, its status flips from “Waiting for the agent to pair…” to Paired followed by the machine’s host name, with a check mark, no refresh needed. Closing and reopening the dialog starts a fresh wait if you are pairing another machine.
Leave the service alone. It has been running since step 2, and it picks the new pairing up on its next check, within about 30 seconds. The agent then shows Online in the Toolkit → Local Agents list, and connections can use the Agent execution mode: the pairing flow switches them over once an agent is up. Paired and Online are two different signals: the dialog flips to Paired the moment step 4’s pairing command succeeds, while Online confirms the service has checked in since.

The pairing step stores an API key on the machine, locked down so only the service account and Administrators can read it (C:\ProgramData\DeltaVault\agent). Your database credentials are never stored on the agent host; it receives connection settings per job, over HTTPS, and holds them in memory only.

macOS and Linux installers aren’t available yet: Windows ships first.

Decommission an agent

Click Revoke on the agent’s row in Toolkit → Local Agents. DeltaVault rejects the agent’s key from that moment, and the service logs that it was revoked and exits. To remove it fully, also uninstall from Programs and Features on the host.

If the agent doesn’t come Online

The service keeps running but never pairs on its own. Pair first: an unpaired service idles rather than exiting, logging Not paired yet: run deltavault-agent pair as Administrator. Checking again in 30s. every 30 seconds until you pair it. If you’ve already paired and it’s still idling, re-run the pairing command as Administrator; pairing codes expire after 15 minutes, so mint a fresh one from the dialog if needed.

Paired, running, but showing as Stale in the list. Stale is what the list shows when an agent has paired but has not checked in recently, and the usual cause is egress: the agent needs outbound HTTPS to your DeltaVault endpoint. Check the machine’s proxy and egress rules; nothing inbound is required.