Install the Access agent on Windows

The Access agent makes a Windows computer reachable from the console at any time, without anyone at the keyboard. It installs as a Windows service named IZT Blink Agent (service name BlinkAgent) that runs as LocalSystem, starts automatically with Windows, and restarts itself if it stops unexpectedly.

There are three ways to install it. All of them need administrator rights on the computer.

Method	Best for
Signed installer	A handful of computers, run by hand
Command line	Scripted rollouts with your management tools
From a support session	A computer you are already connected to

Access is available for Windows 10 or later (64-bit). It is not available on a Mac: see Check supported systems.

Every method needs a plan that includes Unattended Access and a free Access device. Each enrolled computer takes one Access device in your plan: see Access devices.

Use the signed installer

The installer is the Access agent with your enrollment key built in. It installs and enrolls with no questions asked.

1. Create an enrollment key.
2. While the new key is still on screen, select Download installer. Blink prepares a signed agent for this key (the button shows Building… for a moment) and downloads blink-agent-<version>.exe.
3. Copy the file to the computer.
4. Right-click it and choose Run as administrator.

The agent enrolls the computer, copies itself to C:\ProgramData\Blink\blink-agent.exe and starts the service. The computer appears under Access in the console.

Caution

Anyone with the installer can enroll computers into your organization until the key is used up, expires or is revoked. Delete the installer when you are done, and see Keep keys under control.

Note

The signed installer needs a server that can reach IZT to build it. On an offline server, use the command line below with the generic agent.

Use the command line

Use this to roll the agent out with a script, your remote management tool, a software deployment tool or a startup script: anything that can run a program as administrator or as SYSTEM on the computer.

Using an RMM tool?

Deploy the Access agent with your RMM tool has a ready-made script that downloads the agent and enrolls the computer, with steps for NinjaOne, Datto RMM, N-able, ConnectWise, Kaseya, Atera, Syncro, Intune, Group Policy and others.

1. Create an enrollment key and copy it.

2. Download the generic agent: select Agent next to the command on the new key’s card, or Access agent under Instance › License › Agent builds (shown only when your plan includes Unattended Access). The file is blink-agent.exe.

3. On each computer, from an elevated prompt or your deployment tool, run:

   blink-agent.exe --install --enroll <key>

The command runs without any window or prompt. The reason for any failure is printed to the console it was started from and written to C:\ProgramData\Blink\install.log.

Exit codes

The install command, --enroll <key> on its own, and the signed installer all exit with these codes, so your tool can tell what happened:

Code	Meaning
0	The service is installed (or repaired) and started. For --enroll, the computer is enrolled.
1	Something else failed, for example the prompt was not elevated, the server could not be reached, or the key is invalid or used up. Fix the cause and run it again.
2	The command line was wrong, for example an unknown option.
20	Your plan’s device limit is reached. The log says This Blink plan’s device limit is reached. Ask your administrator.
21	Your plan does not include Access. The log says This Blink plan does not include Access. Ask your administrator.

Codes 20 and 21 are final. The agent tries once and does not retry, because nothing changes until an administrator frees an Access device or the plan changes. A refused install is rolled back:

• On a computer that was not enrolled yet, nothing is left running: a leftover IZT Blink Agent service from an earlier attempt is removed, the device identity made for the refused request is deleted, and the agent’s settings are deleted if this run created them.
• On a computer that is already enrolled, nothing changes. It stays an enrolled device.

The C:\ProgramData\Blink folder and its logs stay, so you can read install.log afterwards.

There is no option to choose the server: the agent you download from your console already carries your Blink address.

Run it again safely

Running the install command on a computer that already has the agent is safe. It does not enroll an already enrolled computer again; it repairs the service if needed and makes sure it is running. That makes it suitable for a policy that runs at every start-up.

Have such a policy stop on exit code 20 or 21: running the install again does not help until an administrator frees an Access device or the plan changes. See Exit codes.

Other commands

All of these need an elevated prompt:

Command	What it does
blink-agent.exe --install	Install, repair or start the service on a computer that is already enrolled
blink-agent.exe --enroll <key>	Enroll the computer only, without installing the service
blink-agent.exe --uninstall	Remove the agent: see Uninstall the Access agent

Cloned computers and images

The agent’s identity is tied to the computer it was enrolled on. If you clone a disk or a virtual machine with the agent on it, the copy does not use the original’s identity: its agent stays offline until you enroll it. Run the install command with a key on the copy.

For a golden image, the simplest approach is to leave the agent out of the image and install it on each computer after deployment.

Install from a support session

When you are in a Support session with someone at a Windows computer, you can turn that computer into an Access device without sending a file.

1. In the viewer, if the agent is not running as administrator yet, select Run as admin and follow the prompts (see Run as administrator). The customer approves a Windows prompt at their computer.
2. Select Install Access in the viewer toolbar.
3. Choose the Device group to put the computer in, or No group (org-wide access only) if your role allows that.
4. Select Install. If your last sign-in was a while ago, Blink first asks for your authenticator code or passkey.

The button shows Installing… and then Access installed. The customer is not prompted. Select Open device in console to see the new device.

You only see Install Access if your role has the Install Access permission and your plan includes Attended Support, Install Access from Support and Unattended Access. The computer also needs a free Access device in your plan; at the device limit the install fails and nothing is left installed. If the viewer says Confirm the computer first, do that, then try again. Install Access is available in Support sessions only.

Check the result

Open Access in the console. The new computer shows with its name, OS and agent version, and the status online once the service has connected. From there you can connect to it at any time: see Manage Access devices.

If the computer does not appear or stays offline, check C:\ProgramData\Blink\install.log and C:\ProgramData\Blink\service.log, and see Fix a Blink agent that will not connect.