Deploying SnitchOS with your RMM

For MSP admins: push the code-signed MSI silently through your fleet tooling with the per-tenant wrapper script.

How it works

  1. Sign in to app.snitchos.com as the customer's tenant admin.
  2. Go to Tenants → <customer> → Install agents.
  3. In RMM mass-deploy installer, download Install-SnitchOS-<slug>.ps1 (or .cmd for batch-only RMMs).
  4. Upload the script to your RMM's script library.
  5. Push to every endpoint and run elevated (SYSTEM or an Administrators member).

Embeds the tenant ID, fleet key, and MSI CDN URL; verifies the Authenticode signature; installs silently.

Reuse and deliberate rotation

Normal downloads reuse the current fleet key; tasks keep working. Rotate & download revokes the previous wrapper — for suspected exposure or an admin departure.

Invocation commands

Syncro

Script “SnitchOS Agent - Install or Upgrade (snitchos.com)” from the Syncro Community Script Library (PowerShell, Run as System, max 30 min). Auto-detects:

  • Already installed: silent in-place upgrade. No script variables needed.
  • Not installed: fresh install and self-enrollment. Add one Syncro runtime variable, EnrollmentKey, from Tenants → <tenant> → Install agents at app.snitchos.com. Since agent 1.0.19.0 the key alone identifies the tenant, so there is no TenantId variable to set. The key lands in a locked-down registry key: SYSTEM and Administrators only, never a command line.

Refuses anything without a genuine Authenticode signature; exit 0 means installed and running, output names any other outcome.

NinjaOne / Datto RMM / ConnectWise Automate / Kaseya

Run the downloaded Install-SnitchOS-<slug>.ps1 as SYSTEM via your RMM’s PowerShell script task; most RMMs set the execution policy for the task themselves.

N-able N-central / N-sight

Upload the .ps1 to the script repository; run as a scripted task, execution context Local System (same script as above); idempotent.

Batch-only RMMs

Install-SnitchOS-<slug>.cmd

Uses curl.exe (Windows 10 1803+ / Server 2019+) and msiexec: no PowerShell required.

Microsoft Intune

Add the .ps1 as a Win32 app PowerShell script. Detection rule: presence of C:\Program Files\SnitchOS\SnitchOS.Agent.exe.

Group Policy

Run the .ps1 as a startup script; later re-runs are no-ops once installed.

Verify the rollout

The tenant overview lists each new device within about 60 seconds; every install writes a device.enroll audit-log entry with the source IP.

Run the health helper without showing UI:

& "C:\Program Files\SnitchOS\SnitchOS.HealthCheck.ps1" -Json

SmartScreen and antivirus

  • Verifies the MSI's Authenticode signature against both publisher certificates before invoking msiexec; refuses anything unsigned or mis-signed.
  • RMM-pushed installs normally avoid interactive SmartScreen; behavior is client policy-dependent.
  • Defender or another security product may flag the input-count hook. Verify the Authenticode publisher, then agree an allow rule with the client's security team; file hash changes each release.

One-off manual install

Use the downloadable installer: double-click, no arguments; the wrapper .ps1 also works on one machine.

There is no enrollment-key MSI property; the wrapper writes the key to an ACL-restricted bootstrap registry subkey, owned by SYSTEM or BUILTIN\Administrators. Run the wrapper .ps1, .cmd, or signed .exe from Install agents and mint a single-use, short-expiry key instead of the fleet key.

Double-clicking the bare MSI fails by design with "SnitchOS first install needs TENANT_ID (UUID) plus a provisioned bootstrap key. Use the dashboard's RMM installer script, it writes the enrollment key to the ACL'd bootstrap registry, then runs msiexec with BOOTSTRAP_READY=1." See why the bare MSI refuses to install.

Repair and re-enroll

To repair an endpoint with a bad or missing device token, push the same script through the same RMM task, adding the -Reenroll script parameter.

An enrollment key adds machines only; it can't replace a running machine's token. No action needed for:

  • Reimaged or wiped machine: a new machine GUID enrols it as new; revoke the old row once you see it.
  • Plain reinstall or upgrade: the endpoint keeps its device token and never re-enrols.
  • -Reenroll on an endpoint that still holds its token: the existing token proves it's the device.

Only when the token is genuinely gone (restored image, disk corruption, a hand-deleted registry key) does -Reenroll need help: an administrator arms the device in People → Devices → Allow re-enrolment, one token replacement per 12-hour window, spent by the re-enrolment that uses it.

Order does not matter: the agent retries, so arming after a repair already ran still recovers it. Both halves are audited: who armed it, and which authority was used.

Exception: a capped key with no uses left cannot repair even the machine it originally enrolled; arming won't change that. Mint a fresh key on Install agents and repair with it.

Uninstall and offboarding

A local admin finds the agent as the SnitchOSAgent service in Task Manager or services.msc. It is installed as a system component, so use msiexec /x rather than Settings → Apps to remove it, per endpoint or as an RMM uninstall job:

msiexec /x "{<product-code>}" /qn

Uninstall removes both services and stops collection; data stays in the backend per retention policy. Retiring a device in the dashboard only stops collection; it does not uninstall. Normal uninstall leaves local state behind; to purge it too:

msiexec /x "{<product-code>}" /qn PURGE_CONFIG=1

To decommission a customer: mark the tenant inactive (new enrollments rejected immediately), revoke the fleet key, then uninstall via RMM.