Use the checks below for your platform. Each check shows three possible states: installed and running, installed but stopped, or not installed.

Windows

Option 1: Check the installation folder

Look for the Agent's installation folder:

Hidden Agent: C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}
Revealed Agent: C:\ProgramData\Teramind Agent

If the folder exists, the Agent is installed.

Note: If the Agent was installed with a custom path (the TMROOTDIR installation parameter), the folder will be different. Use Option 3 to find the real install path from the registry.

Option 2: Check the Agent service

Open Windows Command Prompt (cmd.exe) as an administrator and run:

sc query tsvchst

If the Agent is installed and running, you will see:

SERVICE_NAME: tsvchst     TYPE : 10 WIN32_OWN_PROCESS     STATE : 4 RUNNING             (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)     WIN32_EXIT_CODE : 0 (0x0)     SERVICE_EXIT_CODE : 0 (0x0)     CHECKPOINT : 0x0     WAIT_HINT : 0x0

If the Agent is installed but not running, the service exists but shows:

    STATE : 1 STOPPED

Try starting it:

sc start tsvchst

If it fails to start, or stops again shortly after, check whether antivirus software is blocking the Agent before reinstalling.

If the Agent is not installed (or was uninstalled), you will see:

[SC] EnumQueryServicesStatus:OpenService FAILED 1060: The specified service does not exist as an installed service.

Option 3: Check the drivers and the install path

The Agent installs two drivers alongside the main service:

sc query tmfsdrv2 sc query tm_filter

tmfsdrv2 is the file-system driver. It should be present and running. If it is missing or stopped while tsvchst is running, antivirus blocking is the usual cause.
tm_filter is the network driver. It is installed only after network monitoring has been enabled at least once, so its absence is normal on agents where network monitoring was never turned on.

To find where the Agent is actually installed (reliable even with a custom TMROOTDIR path):

reg query HKLM\SYSTEM\CurrentControlSet\Services\tsvchst /v ImagePath

PowerShell equivalent for a one-line check of all three services:

Get-Service tsvchst, tmfsdrv2, tm_filter -ErrorAction SilentlyContinue | Format-Table Name, Status, StartType

Note: On stealth-protected agents (version 26.31+), you will also see an hmon health-check/self-repair service. Its presence is expected; it is part of the Agent, not third-party software.

Mac

Mac Agent 0.1.226 and later

Open Terminal and run:

ps aux | grep -i teramind

If the Agent is installed and running, you will see two processes: tmsysd (the system daemon) and the agent process (Teramind Agent on revealed builds):

root  109  ...  tmsysd user  207  ...  .../Teramind Agent

If the Agent is not installed or not running, the command returns only the grep line itself:

user  61442  ...  grep -i teramind

You can also check the system daemon directly through launchd:

sudo launchctl list | grep -i teramind

If the Agent is running, the output shows com.teramind.tmsysd.

Note: On stealth builds, the per-user agent process uses an obfuscated name, so tmsysd / com.teramind.tmsysd is the reliable thing to check.

Mac Agent 0.1.204 and earlier

Open Terminal and run:

ps aux | grep -i teramind

If the Agent is running, you will see the tmagent process:

root  109  ...  tmagent

If the Agent is not running, the command returns only the grep line itself.

Linux

Open a terminal and check the two Agent services:

systemctl status tmagent systemctl status tmengine

If the Agent is installed and running, tmagent shows active (running):

tmagent.service - TM Agent (v3 daemon)      Active: active (running)

tmengine (the policy + I/O engine) is started by tmagent, so it is normal for it to be enabled indirectly rather than auto-started on its own. On current Agents it should also show active (running) while the agent is up. Older Agent builds do not have tmengine.

Then confirm the session recorder is capturing for logged-in users:

ps aux | grep sessrec

If the Agent is capturing, you will see one sessrec --session process per monitored user session.

If the Agent is not installed, systemctl status tmagent reports:

Unit tmagent.service could not be found.

For scripting, the one-line form is:

systemctl is-active tmagent tmengine

Still not sure?

On your Teramind dashboard, open the Computers page. It shows each Agent's online status and last-seen time, which confirms not just that the Agent is running but that it is connected to your server.

How to verify if the Agent is installed / uninstalled / running