Agents

Adding a device

Add device gives you one line to paste on the machine. It downloads the agent from your server, enrolls it and installs it as a service.

Get the line

Press + in the title bar, n on the Devices page, or the list's Add device button. You need the Manage devices privilege. CERMM makes an enroll token, good for 24 hours and for as many machines as you like, and shows the line for each system.

Untick Allow remote commands for a machine that should only be watched (see Monitor-only machines).

The dialog then waits for the machine to check in, and says when it has.

Linux and macOS

In a terminal, with sudo:

curl -fsSL -k --pinnedpubkey 'sha256//PIN' https://192.168.1.10:4800/install.sh | sudo sh -s -- --token TOKEN

The real line has your server's address, its key (PIN) and the token filled in: copy it from the dialog. -k with --pinnedpubkey means curl skips certificate authorities and accepts only your server's exact key. The script downloads the right build for the machine (amd64, arm64 or 32-bit ARM), checked with the same pin, and runs cermm-agent install.

Windows

In Windows PowerShell, run as Administrator. The line looks like this (shortened):

$b=(New-Object Net.WebClient).DownloadData('http://192.168.1.10:4800/install.ps1');if(…SHA-256 of $b… -ne 'HASH'){throw …};& ([scriptblock]::Create(…)) -Token TOKEN

It fetches the installer over plain HTTP and runs it only if its SHA-256 is the one in the line; the installer checks the agent's download the same way. The token is only on the command line, never sent over plain HTTP. Why plain HTTP.

Windows 10, 11 and Server 2016 or newer. On Windows 7, 8 and 8.1 the installer stops and says so.

What the install does

1. Enrolls first. A bad or expired token fails before anything is put on the machine.
2. Copies the agent into place and writes its config.
3. Registers it with the system's service manager and starts it. On Windows it starts with Windows (not Delayed Start).

The service is called cermm-agent (CERMM Agent). It runs as root on Linux and macOS and as SYSTEM on Windows.

What happens next

• The first report goes out as soon as the agent starts, before its inventory, so the machine shows up within seconds. The inventory (hardware, software, network) follows when it's ready.
• After that it reports every 30 seconds. A machine that hasn't reported for 90 seconds is offline.
• If it can't reach the server it retries every 5 seconds for a minute (it may have just booted), then backs off to every 2 minutes at most.
• Every report carries the machine's name, so a rename shows within one report.

Running the line again on a machine that already has the agent updates it in place.

Reaching the server

The line uses CERMM_URL if you set it, otherwise the server's LAN address. Agents keep that address, so give the server a fixed one. Machines elsewhere need to reach it: over a VPN such as Tailscale, or a port you forward.