Installation
PremioGuard consists of two parts: a Windows agent (the installer you download) and a cloud portal (your browser-based customer dashboard). The installer sets up a Windows service and a lightweight notification process. The cloud portal manages your licenses, whitelists, and activity logs.
Before you install
- Windows 10 or Windows 11 — 64-bit only
- .NET 8 Runtime (the installer will prompt you to download it if missing)
- An Administrator account on the machine
- Internet connection for license activation
- 50 MB free disk space
Step-by-step installation
- Create an account — Go to the registration page and sign up. No credit card is needed for the free trial. You will receive a license key by email.
- Download the installer — Log in to your customer dashboard and click Download. The file is a signed
.exeinstaller. - Verify the publisher — Right-click the downloaded file → Properties → Digital Signatures. The signer should read PremioGuard. Do not run unsigned versions.
- Run as Administrator — Right-click the installer and choose Run as administrator. Accept the UAC prompt.
- Enter your license key — Paste the license key from your email or dashboard. The installer contacts the activation server to bind the key to this machine's hardware fingerprint.
- Complete the installation — The installer registers the Windows service, watchdog, and WMI event subscriptions, then exits. No reboot is required.
- Confirm protection is active — Plug in a USB flash drive. You should see the authorization popup appear within a second or two. The drive will not mount until approved.
The installer does not add a tray icon, toolbar, or startup entry in your taskbar. The agent runs silently as a Windows service. The only visible UI element is the authorization popup, which appears only when a blocked device is detected.
First Run
Once installed, PremioGuard is active immediately. There is no configuration wizard or onboarding screen — protection starts the moment the service registers.
What happens on first boot after install
- The
PremioGuardServiceWindows service starts automatically (set to Automatic startup type). - The service registers WMI permanent event subscriptions for USB device arrival and removal.
- The watchdog process starts and begins monitoring the main service.
- The agent performs an initial license check against the activation server.
Testing that blocking works
- Plug in any USB flash drive or external hard drive.
- Within 1–2 seconds you should see the PremioGuard authorization popup — the device name, Vendor ID, Product ID, and Serial Number are displayed.
- Click Cancel or close the popup. Open File Explorer — the drive should not appear.
- Unplug the device. It was never mounted.
Keyboards, mice, printers, webcams, and other non-storage USB devices will continue working without any prompt — plug them in and they will be recognized normally.
How the Agent Works
The PremioGuard agent runs as two coordinated Windows processes:
| Process | Role | Runs as |
|---|---|---|
PremioGuardService.exe |
Core enforcement engine. Registers WMI event subscriptions, intercepts USB device arrivals, blocks or allows devices, communicates with the cloud API for license and whitelist data. | SYSTEM (Windows service) |
PremioGuardNotify.exe |
User-facing notification UI. Receives device events from the service via named pipe and shows the authorization popup. Handles credential collection. | Logged-in user |
PremioGuardWatchdog.exe |
Monitors the service and restarts it if terminated. Protects service registration and registry keys. | SYSTEM |
Device detection flow
- A USB device is connected. Windows notifies the WMI subsystem.
- The WMI subscription fires. The service receives the device event with VID, PID, serial number, and device class.
- The service checks the device class. If it is HID, printer, audio, or similar — the device is immediately allowed, no action taken.
- If the device class is mass storage or MTP, the service checks the local whitelist cache. If the device is already approved, it is allowed.
- If not whitelisted, the service sends a block event to the notification process via named pipe.
- The notification process shows the authorization popup to the currently logged-in user.
Notifications & UI
PremioGuard's user-facing UI is intentionally minimal. The agent has no system tray icon and no persistent window. The only UI element that appears is the Device Blocked popup.
Device Blocked popup
Device Blocked — PremioGuard
This popup appears whenever an unauthorized USB storage device is plugged in. It shows:
| Field | Description |
|---|---|
| Device Name | Friendly name reported by the device driver (e.g. SanDisk Ultra USB 3.0) |
| Vendor ID (VID) | 4-digit hex code identifying the manufacturer |
| Product ID (PID) | 4-digit hex code identifying the model |
| Serial Number | Unique device serial (some cheap devices report a blank or generic serial) |
| Device Class | USB device class — e.g. Mass Storage, MTP |
Popup buttons
- Allow Device — Opens the admin credential prompt. If credentials are verified, the device is whitelisted and enabled immediately.
- Cancel / Close — Dismisses the popup. The device remains blocked. It can be re-prompted by unplugging and re-plugging.
If the popup does not appear when you plug in a flash drive, the device may already be in the whitelist, or the notification process may not be running. See Troubleshooting for steps.
Tamper Protection
PremioGuard includes a dedicated watchdog process to resist attempts to disable enforcement by terminating the service or removing its registry entries.
What the watchdog does
- Service restart — If
PremioGuardServiceis killed (via Task Manager orsc stop), the watchdog restarts it within seconds. - Registry protection — The watchdog monitors its own service registration keys and restores them if deleted.
- Self-protection — The watchdog itself is registered as a separate service. Killing the watchdog triggers the SCM to restart it according to its recovery policy.
Even a user with local administrator rights cannot permanently disable PremioGuard without going through the official uninstaller. This is by design — it prevents users from bypassing USB blocking by simply stopping the service.
What tamper protection does not cover
- A domain administrator with the ability to run commands as SYSTEM could disable the service and prevent restart by modifying recovery settings before the watchdog can react.
- Reinstalling Windows or booting into a recovery environment bypasses all in-OS protections.
- Tamper protection is a deterrent against casual bypass, not a substitute for physical security or endpoint management policy.
Auto-Updates
PremioGuard checks for updates automatically in the background. When an update is available, it is downloaded, verified, and installed without interrupting USB enforcement.
Update process
- The agent checks the update server periodically. The interval is set by the server and is typically every 24 hours.
- If a new version is available, the update package is downloaded over HTTPS.
- The downloaded package is verified against a SHA-256 manifest signed by PremioGuard. If verification fails, the package is discarded and the update is retried later.
- The installer runs silently. The service stops briefly during file replacement, then restarts — enforcement resumes within seconds.
If you need to control update timing — for example, to test a new version in staging before rolling out to production — contact support to enable admin-controlled update approval in your dashboard.
Dashboard Overview
The customer dashboard is the web portal at your account page. It is the central place to manage your license, view your activated machines, inspect USB activity, and manage the device whitelist.
Dashboard sections
| Section | What it shows |
|---|---|
| Overview | License plan, expiry date, activation count used vs. available, quick stats on blocked devices and activity. |
| Activations | All machines where your license is active. Machine name, hardware ID, activation date, last seen online. |
| Device Whitelist | All USB devices that have been authorized, grouped by machine. Includes device name, VID/PID/serial, and authorization date. |
| Activity Log | Full timestamped log of every USB event across all your machines — connections, disconnections, blocks, and authorizations. |
| Profile | Your account name, email address, password change, and MFA settings. |
Managing Activations
Each plan has a maximum number of simultaneous PC activations. When you install and activate PremioGuard on a machine, it uses one activation slot.
Viewing your activations
- Log in to the dashboard.
- Click Activations in the left sidebar.
- You will see a table listing each activated machine with its hostname, hardware fingerprint hash, activation date, and last check-in timestamp.
Deactivating a machine
Deactivating frees up the activation slot so you can use it on another machine. You should deactivate when:
- Replacing a PC with a new one
- Reinstalling Windows on a machine (the hardware fingerprint changes on major rebuilds)
- Decommissioning a machine
- Go to Activations in the dashboard.
- Find the machine you want to deactivate and click Deactivate.
- Confirm the action. The slot is freed immediately.
- The PremioGuard agent on the deactivated machine will stop enforcing USB policy within minutes of its next license check.
If you no longer have access to the old machine (it was stolen, destroyed, or wiped), contact support to force-deactivate it remotely. Support will verify your identity before proceeding.
Device Whitelist
The device whitelist shows every USB storage device that has been authorized to work on your machines. Entries are stored per machine — authorization on one PC does not automatically allow the same device on another.
Whitelist columns
| Column | Description |
|---|---|
| Machine | The hostname of the PC where this device was authorized. |
| Device Name | Friendly name as reported by the USB driver. |
| VID / PID | 4-digit hex Vendor ID and Product ID identifying the manufacturer and model. |
| Serial Number | Unique serial reported by the device. May be blank for some cheap devices. |
| Authorized By | Admin email that approved the device. |
| Authorized At | Date and time the device was approved. |
Removing a device from the whitelist
- Go to Device Whitelist in the dashboard.
- Find the device you want to remove (you can filter by machine name or search by device name).
- Click Remove next to the device entry.
- Confirm the removal. The device is removed from the server whitelist immediately.
- The agent syncs the updated whitelist within minutes. After sync, that device will be blocked again when plugged into that machine.
Removing a device from the whitelist does not eject it if it is currently plugged in — it will be blocked on the next insertion.
USB Activity Log
The activity log records every USB-related event across all your activated machines. It is the primary tool for auditing USB activity and investigating security incidents.
Event types
| Event | Meaning |
|---|---|
| Connected | A USB device was connected to the machine. Recorded for all device types (storage and non-storage). |
| Disconnected | A USB device was removed from the machine. |
| Blocked | A USB storage device was connected and blocked by PremioGuard. The device was not mounted. |
| Authorized | An admin approved a device. Device was added to the whitelist and allowed to connect. |
| Whitelist Hit | A previously authorized device was connected and automatically allowed. |
Filtering and exporting
- Filter by machine — Narrow the log to a single PC using the machine dropdown.
- Filter by event type — Show only blocked or authorized events for quick security review.
- Date range — Pick a start and end date to scope the log for a compliance period.
- Export to CSV — Download the filtered log as a CSV file suitable for import into a spreadsheet or SIEM tool.
For HIPAA, ISO 27001, or internal audits, export the activity log for the relevant time period and include it in your audit documentation. The log includes timestamps in UTC.
Account & Profile
Your account profile is accessible from the Profile section of the dashboard or via the user menu in the top-right corner.
What you can change
- Display name — The name shown in the dashboard and in authorization event logs.
- Password — Enter your current password, then the new one. Passwords must be at least 8 characters.
- Two-factor authentication (TOTP) — Enable authenticator-app 2FA for additional account security. Strongly recommended for admin accounts, since your credentials are used to authorize USB devices on all your machines.
Your dashboard login credentials are the same credentials used on-device to authorize USB drives. Use a strong, unique password and enable two-factor authentication. If your credentials are compromised, an attacker could authorize storage devices on your machines remotely.
Plans & Billing
PremioGuard is sold per PC. One license key covers one machine for the duration of the plan. All plans include the full feature set — there is no feature gating between tiers.
| Plan | Duration | Activations | Notes |
|---|---|---|---|
| Trial | 7 days | 1 PC | Free, no credit card required |
| Monthly | Renews monthly | 1 PC | Cancel any time |
| Yearly | Renews annually | 1 PC | Best value for ongoing use |
| Lifetime | Perpetual | 1 PC | One-time payment, no renewals |
Upgrading or changing plan
To change plan, log in to the dashboard, go to Overview, and click Change Plan. You will be directed to the billing page. Mid-cycle upgrades are prorated.
What happens if payment fails
If a renewal payment fails, PremioGuard enters a 7-day grace period during which the agent continues enforcing USB policy. If payment is not resolved within 7 days, the license expires and enforcement stops. Update your payment method in the dashboard under Billing.
Hardware Binding
Each PremioGuard license is tied to the hardware of one specific machine. This prevents a single key from being installed on multiple computers.
How the hardware fingerprint is generated
On activation, the agent collects identifiers from four hardware components and hashes them together into a single fingerprint:
| Component | Identifier used |
|---|---|
| CPU | Processor ID from WMI Win32_Processor |
| Motherboard | Serial number from WMI Win32_BaseBoard |
| Primary disk | Serial number from WMI Win32_DiskDrive |
| Network adapter | MAC address of the primary NIC from WMI Win32_NetworkAdapter |
Replacing one component (e.g. adding RAM or a second drive) generally does not change the fingerprint. Replacing the motherboard, CPU, or primary disk may generate a new fingerprint and require re-activation. If this happens, deactivate the old machine from the dashboard and re-run activation.
Transferring a License
You can move your license from one machine to another at any time. The process is self-service via the dashboard.
Transfer steps
- Log in to the customer dashboard.
- Go to Activations and find the machine you are moving away from.
- Click Deactivate and confirm. The activation slot is freed immediately.
- On the new machine, install PremioGuard using the same license key (download the installer from the dashboard).
- Enter the license key during installation. It will bind to the new machine's hardware fingerprint.
If you cannot access the old machine
If the old machine was destroyed, stolen, or wiped before you could deactivate it, contact support with your license key and account email. We will force-deactivate the old machine after verifying your identity, freeing the slot for use on the new machine.
Offline Grace Period
PremioGuard is designed to work in environments where internet connectivity may be intermittent. The agent caches its license state and whitelist locally so it can continue enforcing USB policy without a live connection.
How the grace period works
| Scenario | Behaviour |
|---|---|
| Machine is online | Agent validates license and syncs whitelist on every check-in (typically every few hours). |
| Machine goes offline | Agent continues enforcing using cached license and whitelist for up to 7 days. |
| Machine comes back online | Agent re-validates and syncs automatically in the background. No user action needed. |
| Offline for more than 7 days | The agent enters a degraded state: USB blocking is suspended until connectivity is restored and the license re-validated. |
New device authorizations made in the dashboard while a machine is offline will not take effect until the machine comes back online and syncs. Likewise, whitelist removals won't propagate until the next sync.
What network access does the agent need?
The agent communicates with api.premioguard.com over HTTPS (port 443). If your network uses a web proxy, the agent respects the Windows system proxy settings configured via netsh winhttp set proxy or Internet Explorer / Edge proxy settings.
Troubleshooting
The authorization popup does not appear when I plug in a USB drive.
- Open Windows Services (
services.msc) and confirmPremioGuardServiceis running. If it is stopped, right-click and start it. - Check that
PremioGuardNotify.exeis running in Task Manager under your user session. If not, navigate to the install directory and launch it manually. - Ensure the device is genuinely a mass storage device — keyboards, mice, and chargers will not trigger a popup.
- The device may already be in the whitelist. Check the dashboard under Device Whitelist.
Installation fails with an activation error.
- Confirm the license key is entered exactly as received — no extra spaces.
- Check your internet connection. Activation requires a live connection to the PremioGuard API.
- If your network uses a proxy or firewall, ensure port 443 outbound to
api.premioguard.comis permitted. - Check the dashboard to confirm the license has not already been used on the maximum number of machines. Deactivate an old machine if needed.
My antivirus flagged the installer or the service.
- This is a known false positive caused by PremioGuard's WMI event subscription behaviour — a technique shared with some malware, which causes overly sensitive AV heuristics to flag it.
- Verify the installer's digital signature (right-click → Properties → Digital Signatures) confirms PremioGuard as the publisher.
- Add the PremioGuard install directory and service executable to your AV exclusion list.
- If the issue persists, contact support with the AV product name and the specific alert details.
An authorized device is being blocked again after I removed it from the whitelist.
- Whitelist removals propagate on the agent's next sync cycle (typically within minutes when online). Try unplugging and re-inserting the device after 5 minutes.
- If the machine is offline, the change will not take effect until it reconnects. See Offline Grace Period.
The service was stopped and it restarted on its own.
- This is expected behaviour. The watchdog process monitors the service and restarts it automatically. See Tamper Protection.
- If you need to stop the service for maintenance, use the official uninstaller, or contact support for temporary suspension instructions.
I reinstalled Windows and the license won't activate.
- A clean Windows reinstall changes the hardware fingerprint stored during the original activation, so the old activation is now stale.
- Go to the dashboard → Activations, deactivate the old machine entry, then re-run the installer and activate with your license key.
- If the machine entry no longer shows in the dashboard (because the hardware ID changed on reinstall), contact support to reset the activation count.
Still stuck? Contact support with your license key, Windows version (Settings → System → About), and a description of the problem. Attaching screenshots speeds up diagnosis significantly.
Uninstalling
The PremioGuard uninstaller removes the service, watchdog, WMI subscriptions, registry keys, and all application files. Nothing is left behind after a clean uninstall.
Uninstall steps
- Open Windows Settings → Apps → Installed apps (Windows 11) or Control Panel → Programs and Features (Windows 10).
- Search for PremioGuard in the list.
- Click Uninstall (Windows 11) or select it and click Uninstall in the toolbar.
- Accept the UAC prompt. The uninstaller runs silently and exits when complete.
- USB storage devices will now connect normally — blocking is no longer active.
After uninstalling, deactivate the machine in the dashboard to free up your activation slot for future use. The uninstaller does not automatically deactivate — you must do this manually from the portal.
What is removed
- Windows service:
PremioGuardService - Windows service:
PremioGuardWatchdog - WMI permanent event subscriptions
- All registry keys under
HKLM\SOFTWARE\PremioGuard - Application files in the install directory (default:
C:\Program Files\PremioGuard) - Local license cache and whitelist cache files
What is not removed
- Your cloud dashboard account and data — these remain accessible for re-installation or record-keeping.
- Activity logs stored on the server — retained for 12 months per your plan.