FlowRMM

Operator Guides

Agent Installers & Enrollment Security

Operators mint an enrollment token in the portal, install the agent on acme-wks-01 under Acme Corp / Acme HQ, then rotate or revoke tokens when the rollout window closes.

This guide covers the Cohort 01 enrollment path operators actually run: mint a token, bootstrap an agent, confirm the endpoint appears, and rotate or clean up safely. Internal signing pipelines and cloud deploy scripts are out of scope for the public site.

Mint an enrollment token

  1. Open Installers.
  2. Mint or reveal the shared tenant enrollment token (or create a short-lived automation token when a pipeline needs one).
  3. Choose a lifetime that matches the rollout window (for example 30 / 90 / 365 days). Prefer short windows for pilots; never-expire is available but not recommended.
  4. Copy the bootstrap command for the target OS. Treat the token like a secret: do not paste it into tickets or chat.

Token create / reveal / rotate events belong in audit history. Rotate when staff change, a token leaks, or the rollout window ends: rotation requires an explicit confirmation phrase in the portal.

Enroll an Acme endpoint

  1. Run the Installers bootstrap on the target machine with a valid enrollment token.
  2. Confirm the device appears under Endpoints.
  3. Assign it to client Acme Corp and site Acme HQ (or your real hierarchy) before you start remote work.
  4. On macOS, complete Screen Recording and Accessibility grants when prompted so remote view/control can work.

Supported agent footprint: Windows, macOS, and Linux. Exact remote-session feel still depends on OS session state and permissions.

macOS privacy after uninstall / reinstall

Uninstall removes the app, but macOS may keep stale Privacy & Security entries. After a clean reinstall:

  1. Confirm /Applications/FlowRMM Agent.app exists again.
  2. In System Settings → Privacy & Security, remove stale FlowRMM Agent rows under Screen Recording and Accessibility.
  3. Re-add the new app and turn the grants on.
  4. Rerun first setup if needed, then sign out/in or reboot if capture still fails before login.

Uninstall / cleanup

Use the Installers cleanup command for the OS, or portal remote uninstall when you intend to remove the registration after the agent cleans up.

  • Windows: elevated cleanup stops the agent service, uninstalls the package when present, and removes FlowRMM program data.
  • macOS: cleanup must remove the root LaunchDaemon as well as the app: user-only LaunchAgent cleanup is not enough.
  • Linux: stop/disable the agent service and remove the FlowRMM install and state directories.

Security posture operators should expect

  • Enrollment requires a valid token scoped to the tenant.
  • Agent secrets are not meant to live in plaintext env files; each OS uses a protected store appropriate to the platform.
  • Prefer rotating the shared token after a pilot wave rather than leaving a long-lived secret in scripts.

Related guides

Want hands-on help evaluating Cohort 01? Book a demo or apply for Cohort 01.

All docsBook a DemoApply for Cohort 01