Requirements
On this page
What Signal needs to run: privileges, Windows versions, and the resources a run uses.
Privileges
signal live needs an elevated administrator prompt, or SYSTEM. Every fleet deployment tool runs it as SYSTEM.
Required | An elevated administrator prompt, or SYSTEM. |
Not required | A domain account, any directory permission (the directory is never queried), network access, or write access anywhere except where you write the run. |
Privilege enabled |
|
Never used |
|
The other commands (signal version, list, rules -check, profile -check) need no elevation.
Windows versions
Supported | |
|---|---|
Clients | Windows 10 (1607 and later) and Windows 11, every edition. |
Servers | Windows Server 2016, 2019, 2022 and 2025, with Desktop Experience or Server Core, including domain controllers. |
Architecture | x64 (amd64). Not ARM64, not 32-bit. |
Not supported | Windows 8.1, Server 2012 R2 and older. |
A source a Windows build lacks (a log, a WMI class, an audit subcategory) is reported as not read, with why. It is never reported as "nothing found".
Resources
Measured on a 12-CPU, 32 GB Windows 11 host:
Condition | Time | Peak memory |
|---|---|---|
Default (all CPUs) | 8 - 9 s | 190 - 230 MB |
2 cores, below-normal priority | 18 - 19 s | 140 - 170 MB |
1 core, idle priority | 29 - 31 s | about 135 MB |
Minimum | Recommended | |
|---|---|---|
CPU | 1 core | 2 cores or more |
Free memory | 300 MB | 512 MB |
Disk | About 9 MB for the program; a run is 0.5 - 20 MB of JSON | |
Network | None, unless you push the run to Signal Console or write it to a share |
A run takes longer on hosts with large event logs and many user profiles. Signal runs at below-normal CPU priority, so the host's own work comes first.
Before a fleet run
Signal is new and rarely seen, and it reads what credential theft also touches. Security products may flag it. Ask your security team to allow it by hash first: see Antivirus and EDR.
Next
Install and verify Signal.