# Install the Access agent on Windows

The Access agent makes a Windows computer reachable from the console at any time, without anyone at the keyboard. It installs as a Windows service named **IZT Blink Agent** (service name `BlinkAgent`) that runs as LocalSystem, starts automatically with Windows, and restarts itself if it stops unexpectedly.

There are three ways to install it. All of them need administrator rights on the computer.

| Method | Best for |
|---|---|
| [Signed installer](#use-the-signed-installer) | A handful of computers, run by hand |
| [Command line](#use-the-command-line) | Scripted rollouts with your management tools |
| [From a support session](#install-from-a-support-session) | A computer you are already connected to |

Access is available for Windows 10 or later (64-bit). It is not available on a Mac: see [Check supported systems](/install/supported-systems/).

Every method needs a plan that includes **Unattended Access** and a free Access device. Each enrolled computer takes one Access device in your plan: see [Access devices](/configure/plans-and-limits/#access-devices).

## Use the signed installer

The installer is the Access agent with your enrollment key built in. It installs and enrolls with no questions asked.

1. [Create an enrollment key](/install/enrollment-keys/).
2. While the new key is still on screen, select **Download installer**. Blink prepares a signed agent for this key (the button shows **Building…** for a moment) and downloads `blink-agent-<version>.exe`.
3. Copy the file to the computer.
4. Right-click it and choose **Run as administrator**.

The agent enrolls the computer, copies itself to `C:\ProgramData\Blink\blink-agent.exe` and starts the service. The computer appears under **Access** in the console.

:::caution
Anyone with the installer can enroll computers into your organization until the key is used up, expires or is revoked. Delete the installer when you are done, and see [Keep keys under control](/install/enrollment-keys/#keep-keys-under-control).
:::

:::note
The signed installer needs a server that can reach IZT to build it. On an offline server, use the command line below with the generic agent.
:::

## Use the command line

Use this to roll the agent out with a script, your remote management tool, a software deployment tool or a startup script: anything that can run a program as administrator or as SYSTEM on the computer.

:::tip[Using an RMM tool?]
[Deploy the Access agent with your RMM tool](/install/deploy-with-rmm/) has a ready-made script that downloads the agent and enrolls the computer, with steps for NinjaOne, Datto RMM, N-able, ConnectWise, Kaseya, Atera, Syncro, Intune, Group Policy and others.
:::

1. [Create an enrollment key](/install/enrollment-keys/) and copy it.
2. Download the generic agent: select **Agent** next to the command on the new key's card, or **Access agent** under **Instance** › **License** › **Agent builds** (shown only when your plan includes **Unattended Access**). The file is `blink-agent.exe`.
3. On each computer, from an elevated prompt or your deployment tool, run:

   ```bat
   blink-agent.exe --install --enroll <key>
   ```

The command runs without any window or prompt. The reason for any failure is printed to the console it was started from and written to `C:\ProgramData\Blink\install.log`.

### Exit codes

The install command, `--enroll <key>` on its own, and the signed installer all exit with these codes, so your tool can tell what happened:

| Code | Meaning |
|---|---|
| `0` | The service is installed (or repaired) and started. For `--enroll`, the computer is enrolled. |
| `1` | Something else failed, for example the prompt was not elevated, the server could not be reached, or the key is invalid or used up. Fix the cause and run it again. |
| `2` | The command line was wrong, for example an unknown option. |
| `20` | Your plan's device limit is reached. The log says **This Blink plan's device limit is reached. Ask your administrator.** |
| `21` | Your plan does not include Access. The log says **This Blink plan does not include Access. Ask your administrator.** |

Codes `20` and `21` are final. The agent tries once and does not retry, because nothing changes until an administrator frees an Access device or the plan changes. A refused install is rolled back:

- On a computer that was not enrolled yet, nothing is left running: a leftover **IZT Blink Agent** service from an earlier attempt is removed, the device identity made for the refused request is deleted, and the agent's settings are deleted if this run created them.
- On a computer that is already enrolled, nothing changes. It stays an enrolled device.

The `C:\ProgramData\Blink` folder and its logs stay, so you can read `install.log` afterwards.

There is no option to choose the server: the agent you download from your console already carries your Blink address.

### Run it again safely

Running the install command on a computer that already has the agent is safe. It does not enroll an already enrolled computer again; it repairs the service if needed and makes sure it is running. That makes it suitable for a policy that runs at every start-up.

Have such a policy stop on exit code `20` or `21`: running the install again does not help until an administrator frees an Access device or the plan changes. See [Exit codes](#exit-codes).

### Other commands

All of these need an elevated prompt:

| Command | What it does |
|---|---|
| `blink-agent.exe --install` | Install, repair or start the service on a computer that is already enrolled |
| `blink-agent.exe --enroll <key>` | Enroll the computer only, without installing the service |
| `blink-agent.exe --uninstall` | Remove the agent: see [Uninstall the Access agent](/install/uninstall-the-agent/) |

### Cloned computers and images

The agent's identity is tied to the computer it was enrolled on. If you clone a disk or a virtual machine with the agent on it, the copy does not use the original's identity: its agent stays offline until you enroll it. Run the install command with a key on the copy.

For a golden image, the simplest approach is to leave the agent out of the image and install it on each computer after deployment.

## Install from a support session

When you are in a Support session with someone at a Windows computer, you can turn that computer into an Access device without sending a file.

1. In the viewer, if the agent is not running as administrator yet, select **Run as admin** and follow the prompts (see [Run as administrator](/use/run-as-administrator/)). The customer approves a Windows prompt at their computer.
2. Select **Install Access** in the viewer toolbar.
3. Choose the **Device group** to put the computer in, or **No group (org-wide access only)** if your role allows that.
4. Select **Install**. If your last sign-in was a while ago, Blink first asks for your authenticator code or passkey.

The button shows **Installing…** and then **Access installed**. The customer is not prompted. Select **Open device in console** to see the new device.

You only see **Install Access** if your role has the **Install Access** permission and your plan includes **Attended Support**, **Install Access from Support** and **Unattended Access**. The computer also needs a free Access device in your plan; at the device limit the install fails and nothing is left installed. If the viewer says **Confirm the computer first**, do that, then try again. Install Access is available in Support sessions only.

## Check the result

Open **Access** in the console. The new computer shows with its name, OS and agent version, and the status **online** once the service has connected. From there you can connect to it at any time: see [Manage Access devices](/use/manage-devices/).

If the computer does not appear or stays offline, check `C:\ProgramData\Blink\install.log` and `C:\ProgramData\Blink\service.log`, and see [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).