The agent is built for your site, not for the internet.
There is no generic installer to download here, and that is the design. Every agent carries the site it enrols into, inside the executable — so it is built and downloaded from your own console, by somebody entitled to enrol machines there.
Three pieces, and only one of them goes on the endpoint.
The agent — Windows
A signed installer carrying your site. Runs as a service, survives reboots and user sessions, and updates itself from your instance when you publish a new build.
The viewer — Windows
A native remote-session client: multi-monitor, clipboard both ways, file transfer and the key combinations the operating system reserves. Optional — sessions also run in a browser.
Mass deployment
One installer for a whole estate, ready for Group Policy, Intune, PDQ or a golden image — with the PowerShell one-liner generated for the site you choose.
What the endpoint needs.
- Windows 7 SP1 or Windows Server 2008 R2 SP1 and newer, through Windows 11 and Server 2025
- Windows 7 and Server 2008 R2 need the SHA-2 signing (KB4474419) and TLS 1.2 (KB3140245) updates; the installer checks and names any that are missing
- 64-bit (x64) only. Roughly 120 MB on disk once installed
- Linux: x86_64 with systemd and glibc 2.34 or newer — a .deb for Ubuntu and Debian, an .rpm for Rocky Linux and RHEL, installed as root
- Outbound HTTPS on 443 to your instance — no inbound firewall rule at the endpoint
- Local administrator rights to install; the service then runs as SYSTEM
- No agent-side dependency on .NET or a specific PowerShell version
How to check what you are installing
Every installer is code-signed and the agent verifies the signature of any update before it will replace itself. The console shows the package digest of the build your fleet is running, so “are they all on the same version” is a fact rather than an assumption.
Four ways onto an estate.
By hand
Fine for ten machines and the fastest way to evaluate.
Group Policy
A software installation policy pointed at a share holding your installer.
Intune
Wrap the installer and assign it to a device group.
Existing RMM
Push it as a package from whatever you are replacing. It is a silent install.
One installer can onboard a whole estate — the enrolment credential inside it is reusable and revocable, so you are not generating a file per machine. Machines land in the site the installer was built for, and an installer built for one tenant cannot enrol into another.
Get an installer
Start a trial and the console will build one for your first site. Ten machines is enough to judge it.