Command-line tool (portwall-admin)

portwall-admin is the on-box tool for recovery, bootstrap and diagnostics. It works directly on the local database and files — no API key and no network — so it works during an outage, on the box itself. It is portwall-admin.exe in the control-plane folder of the install folder: C:\portwall\control-plane\portwall-admin.exe on a default install. It is not on the system path, so type the full path as shown.

The commands on this page assume PortWall is installed in the default folder, C:\portwall. If you chose another folder when you installed it, replace C:\portwall with that folder.

Run it from an elevated (Administrator) PowerShell or Command Prompt for the credential commands.

C:\portwall\control-plane\portwall-admin.exe <command> [options]

--db defaults to C:\portwall\data\portwall-control-plane.db on every command; pass it only for a non-standard install path.

reset-password

Reset an operator's password — or create the operator if it doesn't exist (this is how you bootstrap the first admin). Requires elevation.

C:\portwall\control-plane\portwall-admin.exe reset-password --user <name> (--password <pw> | --generate) [--role admin|viewer] [--db <path>]

• --user <name> — the operator (required).
• --password <pw> — set this exact password (at least 10 characters).
• --generate — generate a strong random password and print it to stdout.
• --role admin|viewer — role to use only if creating the user (default admin). An existing user's role is preserved.

Examples

C:\portwall\control-plane\portwall-admin.exe reset-password --user admin --generate
C:\portwall\control-plane\portwall-admin.exe reset-password --user alice --password "Str0ng-Passphrase!"

ensure-admin

Idempotent bootstrap for the installer: create the initial admin only if none exists, printing the generated password. Safe to run repeatedly. Requires elevation.

C:\portwall\control-plane\portwall-admin.exe ensure-admin [--user admin] [--password <pw>] [--db <path>]

list-users

List the console operators (usernames, roles, enabled state).

C:\portwall\control-plane\portwall-admin.exe list-users [--db <path>]

disable-2fa

Clear an operator's two-factor authentication from the box — the recovery path when someone loses their authenticator. Afterwards they sign in with just their password. Requires elevation.

C:\portwall\control-plane\portwall-admin.exe disable-2fa --user <name>

Example

C:\portwall\control-plane\portwall-admin.exe disable-2fa --user alice

diagnose

Check this host and explain anything wrong in plain English — licence state, config delivery, certificates, detection sources, and more. Read-only, needs no API key, so it works on a customer's box during an incident.

C:\portwall\control-plane\portwall-admin.exe diagnose [--config <path>] [--db <path>] [--cert-dir <dir>] [--report <file>] [--all]

• --all — include the more verbose sections.
• --report <file> — also write the report to a file.

Exit codes: 0 healthy, 1 warnings, 2 at least one failure.

Example

C:\portwall\control-plane\portwall-admin.exe diagnose --all

scan

Scan a folder for malware and quarantine anything found, printing the report as JSON. Run by the service as needed; you can also run it manually.

C:\portwall\control-plane\portwall-admin.exe scan --path <dir> [--site <name>] [--quarantine <dir>] [--yara <dir>] [--max-bytes <n>] [--db <path>]

• --path <dir> — folder to scan (required).
• --site <name> — attribute findings to a site.
• --max-bytes <n> — skip files larger than this.

restore

Put a quarantined file back at its original path — the mirror of scan, for a false positive.

C:\portwall\control-plane\portwall-admin.exe restore --sha256 <hash> [--quarantine <dir>] [--db <path>] [--install-root <dir>]

• --sha256 <hash> — the hash of the quarantined file (from the scan report or the Quarantine page).

help

C:\portwall\control-plane\portwall-admin.exe help

Prints the built-in usage — the authoritative list for the exact build you have.