Sentinel: a calmer look at home security.

Network

Unauthenticated connect-scan with banner and HTTP HEAD identification, plus listening sockets on this PC.

Windows hardening

Defender real-time protection, firewall profiles, UAC, WDigest, LSA protection, NTLM, AlwaysInstallElevated, SMBv1, LLMNR, BitLocker and Secure Boot.

Remote access

RDP and Network Level Authentication, WinRM, Remote Registry and Telnet, plus a hunt for remote-management (RMM) tools.

Autoruns

Run and RunOnce keys, Startup folders, services (including unquoted paths), scheduled tasks, Winlogon, IFEO debuggers and AppInit_DLLs.

Accounts & event logs

Local administrators, the Guest account and saved credentials in Credential Manager. Event log triage for failed logons (4625), RDP sign-ins (4624 type 10), new services (7045) and PowerShell script blocks (4104).

Integrity & signatures

Hosts file, user proxy, USB storage history and SMB shares. Downloads public malware hash lists from MalwareBazaar, ThreatFox and URLhaus; nothing is uploaded from your PC. Export findings as Markdown or HTML.

What is Sentinel?

Sentinel is a pair of local security-check utilities by James Murphy: Sentinel 3.0 for Mac and Sentinel 2.0 for Windows. The Mac app explains which settings to turn on, which sharing to turn off and who is on your Wi-Fi; the Windows app is a more detailed defensive scanner for your LAN and PC.

Is Sentinel for Mac free?

Yes, Sentinel for Mac 3.0 is free to download and use. It is a 1.1 MB ZIP download for Apple Silicon Macs running macOS 14 Sonoma or later.

Is Sentinel a malware scanner?

Not on the Mac: Sentinel for Mac has no malware scanner, because Apple's built-in protections (XProtect, Gatekeeper, Automatic Updates) cover that job. Sentinel 2.0 for Windows uses public malware hash lists from MalwareBazaar, ThreatFox and URLhaus as one of its checks, but it is not a substitute for Microsoft Defender or an EDR product.

Which Macs and Windows PCs does Sentinel run on?

Sentinel runs on Apple Silicon Macs with macOS 14 or later and on 64-bit Windows 10 or 11. The Mac build is arm64 only, so Intel Macs are not supported.

Does Sentinel hack or attack devices on my network?

No, Sentinel does not try passwords, break into devices, or send attack payloads. It only identifies what each device is offering, and you should use it only on networks you own or are allowed to check.

How are the Mac and Windows versions different?

They have different feature sets. Sentinel for Mac 3.0 is a simple home safety helper, while Sentinel 2.0 for Windows adds Windows hardening, remote access, autoruns, accounts and event log checks.

Is Sentinel signed or notarized?

No, neither app is signed with a developer certificate. The Mac app is ad-hoc signed and not notarized, so use System Settings → Privacy & Security → Open Anyway; the Windows exe is unsigned, so choose More info, then Run anyway in SmartScreen.

See the install steps

Is Sentinel related to Microsoft Sentinel or SentinelOne?

No. Sentinel by James Murphy is an independent project and is not affiliated with Microsoft Sentinel or SentinelOne.

What does Sentinel for Mac check?

Firewall and Stealth Mode, FileVault disk encryption, System Integrity Protection, app safety checks, automatic updates, Guest User, and sharing (Remote Login, Screen Sharing, Remote Management, File Sharing, Remote Apple Events), each with the exact System Settings clicks. It also lists the devices on your Wi-Fi in plain language.

Does Sentinel 2.0 for Windows upload anything from my PC?

No. It downloads public hash lists from MalwareBazaar, ThreatFox and URLhaus as one of its checks; nothing is uploaded from your PC.

Can I save or export Sentinel's results?

Yes. Sentinel for Mac can save its report as Markdown, and Sentinel 2.0 for Windows exports findings as Markdown or HTML.

Do I need to run Sentinel for Windows as Administrator?

For a complete pass, yes. Running as Administrator lets it read the Security event log and some Defender and service keys.