# Deploy the Access agent with your RMM tool

If you already manage your customers' computers with a remote monitoring and management (RMM) tool, you can roll the Access agent out to all of them with one script. The script downloads the agent from your Blink address, checks its signature, installs it and enrolls the computer with your key. It runs silently, needs no one at the keyboard, and is safe to run again on a computer that already has the agent.

This page gives you the scripts, then the steps for each tool. For what the install command itself does, see [Install the Access agent on Windows](/install/access-agent-windows/#use-the-command-line). Moving from another remote access tool? See [Switch from your old remote access tool](#switch-from-your-old-remote-access-tool).

## Before you start

- **An enrollment key for each customer.** A key enrolls computers into one organization and, optionally, one device group. Create one key per customer (or per site), with a **Max uses** that matches the rollout and an expiry you are comfortable with. See [Create an enrollment key](/install/enrollment-keys/).
- **Your Blink address**, for example `https://yourname.onblink.cloud`.
- **Free Access devices in your plan.** Each enrolled computer takes one. See [Access devices](/configure/plans-and-limits/#access-devices).
- **Windows 10 or later, 64-bit (x64).** See [Check supported systems](/install/supported-systems/).
- **A direct connection to your Blink address.** The agent does not use a web proxy and refuses HTTPS inspection. Exclude your Blink address from both before the rollout. Otherwise the script's download can succeed through the proxy while the installed agent cannot connect, and the computer stays **offline**. See [Network](/install/supported-systems/#network).

The script runs as the system account or as an administrator, which is how these tools run scripts by default. It works in 32-bit and 64-bit PowerShell.

### Where the agent comes from

Every Blink server hands out the generic Access agent at:

```
https://<your Blink address>/api/agent/binary
```

This is the same file as **Access agent** under **Instance** › **License** › **Agent builds**. It is signed by **IZT Apps, Inc.**, carries your Blink address, and holds no enrollment key, so the URL needs no sign-in and is safe to put in a script. The key is passed on the command line instead, which keeps it out of the file and lets you keep it in your tool's protected fields.

:::caution[Self-signed certificate on premises]
If your Blink server still uses its built-in certificate (browsers show a certificate warning), Windows refuses the download. [Set up a trusted certificate](/install/certificates/), or upload `blink-agent.exe` to your tool and use the [variant that skips the download](#if-your-tool-ships-the-file).
:::

### Keep the key secret

Anyone with an enrollment key can enroll computers into that organization until the key is used up, expires or is revoked. Put the key in your tool's secure or password-type field where it has one, not in the script text, and never in a script library shared outside your company. Many tools keep a copy of a script's command line or text in their logs and job history, so assume the key can be read there too. Give each key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done. See [Keep keys under control](/install/enrollment-keys/#keep-keys-under-control).

### Tell your security tools first

Installing a new remote access tool on many computers at once is exactly what attackers do, so security tools watch for it:

- **Tell your SOC or MDR provider** before a mass rollout, so they expect the new service and do not isolate computers.
- **Application control** (ThreatLocker, AppLocker, App Control for Business and similar): allow Blink by its publisher, **IZT Apps, Inc.**, not by file hash or certificate thumbprint. The agent replaces itself with every update, and its signing certificate is renewed every few days, so hashes and thumbprints keep changing. The script runs the downloaded file from the system's temp folder (`C:\Windows\Temp` when it runs as the system account). If your policy blocks programs there, allow it or use the [file directly](#if-your-tool-ships-the-file).
- **Microsoft Defender**: the attack surface reduction rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** can block a newly released agent version for its first days. If you use that rule, add an exclusion for `C:\ProgramData\Blink\blink-agent.exe` and for the script's download.

### How tools can tell the agent is installed

The Access agent does not appear in **Apps** or **Programs and Features**, so a tool that checks for installed software by its display name never finds it and tries to install it again every time. Detect it by either of these instead:

- The Windows service `BlinkAgent` (registry key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent`).
- The file `C:\ProgramData\Blink\blink-agent.exe`. Its product version is the agent version.

## The PowerShell script

Use this with any tool that runs PowerShell. Tools hand values to scripts in different ways, so the script takes the Blink address and the enrollment key from the first of these it finds:

1. The variables `$BlinkAddress` and `$EnrollKey`, if your tool sets them or you add lines that set them (the steps for your tool say which lines). A placeholder your tool left unfilled, such as `{{...}}`, `{[...]}` or `@...@`, counts as not set.
2. Two command-line arguments: the address, then the key.
3. The environment variables `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`.

```powershell
# Install and enroll the IZT Blink Access agent.
# Exit codes: 0 installed, 1 failed, 2 address or key missing,
# 20 device limit reached, 21 plan does not include Access.

# >>> Lines for your tool go here (see the steps for your tool). <<<

# A placeholder your tool left unfilled counts as not set.
$placeholder = '^\s*(\{\{.*\}\}|\{\[.*\]\}|\x40.*\x40)\s*$'
if ("$BlinkAddress" -match $placeholder) { $BlinkAddress = $null }
if ("$EnrollKey" -match $placeholder)    { $EnrollKey    = $null }

if (-not $BlinkAddress -and $args.Count -ge 2 -and "$($args[0])" -notlike '-*') {
    $BlinkAddress = "$($args[0])"
    $EnrollKey    = "$($args[1])"
}
if (-not $BlinkAddress) { $BlinkAddress = $env:BLINK_ADDRESS }
if (-not $EnrollKey)    { $EnrollKey    = $env:BLINK_ENROLL_KEY }
$BlinkAddress = "$BlinkAddress".Trim().TrimEnd('/')
$EnrollKey    = "$EnrollKey".Trim()

$ErrorActionPreference = 'Stop'
$ProgressPreference    = 'SilentlyContinue'

if (-not $BlinkAddress -or -not $EnrollKey) {
    Write-Output 'Blink: set the Blink address and the enrollment key.'
    exit 2
}
if ($BlinkAddress -notmatch '^https?://') { $BlinkAddress = 'https://' + $BlinkAddress }

# Windows PowerShell 5.1 may not offer TLS 1.2 by default: add it.
# (No effect on PowerShell 7; not allowed in Constrained Language Mode.)
if ($ExecutionContext.SessionState.LanguageMode -eq 'FullLanguage') {
    $tls = [Net.ServicePointManager]::SecurityProtocol
    if ([int]$tls -ne 0) {
        [Net.ServicePointManager]::SecurityProtocol = $tls -bor [Net.SecurityProtocolType]::Tls12
    }
}

# Already installed and running: nothing to do.
$service = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq 'Running') {
    Write-Output 'Blink: the Access agent is already installed and running.'
    exit 0
}

# Download into a new folder of its own, which other users cannot find.
$temp = if ($env:TEMP) { $env:TEMP } else { Join-Path $env:SystemRoot 'Temp' }
$dir  = Join-Path $temp ('blink-' + [guid]::NewGuid().ToString('N'))
$exe  = Join-Path $dir 'blink-agent.exe'
$url  = $BlinkAddress + '/api/agent/binary'

try {
    $null = New-Item -ItemType Directory -Path $dir -Force
    Invoke-WebRequest -Uri $url -OutFile $exe -UseBasicParsing
} catch {
    Write-Output "Blink: could not download the agent from $url : $($_.Exception.Message)"
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}

# Run the file only if it is signed by IZT Apps, Inc.
$sig = Get-AuthenticodeSignature -FilePath $exe
if ($sig.Status -ne 'Valid' -or "$($sig.SignerCertificate.Subject)" -notmatch '(^|,\s*)CN="?IZT Apps, Inc\."?(,|$)') {
    Write-Output 'Blink: the downloaded file is not signed by IZT Apps, Inc., so it was not run.'
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}

$code = 1
try {
    $p = Start-Process -FilePath $exe -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru -WindowStyle Hidden
    if ($null -eq $p.ExitCode) { throw 'its exit code could not be read.' }
    $code = $p.ExitCode
} catch {
    Write-Output "Blink: could not run the agent installer: $($_.Exception.Message)"
} finally {
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
}

switch ($code) {
    0       { Write-Output 'Blink: the Access agent is installed and enrolled.' }
    20      { Write-Output "Blink: this Blink plan's device limit is reached." }
    21      { Write-Output 'Blink: this Blink plan does not include Access.' }
    default {
        Write-Output "Blink: the install failed with exit code $code."
        $log = Join-Path $env:ProgramData 'Blink\install.log'
        Get-Content -LiteralPath $log -Tail 20 -ErrorAction SilentlyContinue
    }
}
exit $code
```

The script passes the agent's own exit code back to your tool, so a failed install shows as failed. The codes are the ones in [Exit codes](/install/access-agent-windows/#exit-codes); the script adds `2` when the address or key is missing. On a failure it prints the end of `C:\ProgramData\Blink\install.log` into the job output, so you can usually see the reason without connecting to the computer.

Before it runs the download, the script checks that the file carries a valid signature from **IZT Apps, Inc.** and stops with exit code `1` if it does not.

:::note[Running the saved file yourself]
If you start the script file from a command line, use `powershell.exe -File install-blink.ps1 <address> <key>`. With `-Command` instead of `-File`, PowerShell turns every exit code other than `0` into `1`, so your tool cannot tell `20` and `21` apart from other failures.
:::

## The Command Prompt script

Use this where your tool runs batch files, or for a Group Policy startup script. It needs `curl.exe`, which is part of Windows 10 and 11; keep Windows up to date so it is a current version. It retries the download for about two minutes, because at start-up the network may not be ready yet.

```bat
@echo off
rem Install and enroll the IZT Blink Access agent.
rem Exit codes: 0 installed, 1 failed, 2 address or key missing,
rem 20 device limit reached, 21 plan does not include Access.
setlocal
if not defined BLINK_ADDRESS set "BLINK_ADDRESS=https://yourname.onblink.cloud"
if not defined BLINK_ENROLL_KEY set "BLINK_ENROLL_KEY=PASTE-YOUR-KEY-HERE"

if "%BLINK_ENROLL_KEY%"=="PASTE-YOUR-KEY-HERE" (
    echo Blink: set the Blink address and the enrollment key.
    exit /b 2
)
if "%BLINK_ADDRESS:~-1%"=="/" set "BLINK_ADDRESS=%BLINK_ADDRESS:~0,-1%"

rem Already installed and running: nothing to do.
sc query BlinkAgent | find "RUNNING" >nul && (echo Blink: the Access agent is already installed and running.& exit /b 0)

rem Download into a new folder that only SYSTEM and administrators can write to.
set "CODE=1"
set "DIR=%TEMP%\blink-%RANDOM%%RANDOM%"
mkdir "%DIR%" || (echo Blink: could not create a download folder.& exit /b 1)
icacls "%DIR%" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F >nul || goto :done
set "EXE=%DIR%\blink-agent.exe"
if exist "%EXE%" goto :done

rem Try for about two minutes: at start-up the network may not be ready yet.
set "TRIES=0"
:download
set /a TRIES+=1
"%SystemRoot%\System32\curl.exe" --fail --silent --show-error --location --ssl-revoke-best-effort --connect-timeout 30 --max-time 300 --output "%EXE%" "%BLINK_ADDRESS%/api/agent/binary"
if not errorlevel 1 goto :install
if %TRIES% geq 6 (
    echo Blink: could not download the agent from %BLINK_ADDRESS%.
    goto :done
)
ping -n 21 127.0.0.1 >nul
goto :download

:install
"%EXE%" --install --enroll "%BLINK_ENROLL_KEY%"
set "CODE=%ERRORLEVEL%"
if "%CODE%"=="0"  echo Blink: the Access agent is installed and enrolled.
if "%CODE%"=="20" echo Blink: this Blink plan's device limit is reached.
if "%CODE%"=="21" echo Blink: this Blink plan does not include Access.
if not "%CODE%"=="0" if not "%CODE%"=="20" if not "%CODE%"=="21" echo Blink: the install failed with exit code %CODE%. See C:\ProgramData\Blink\install.log.

:done
rd /s /q "%DIR%" >nul 2>&1
exit /b %CODE%
```

Replace the two `set` values, or have your tool set `BLINK_ADDRESS` and `BLINK_ENROLL_KEY` before the script runs. Unlike the PowerShell script, it does not check the file's signature before running it.

## If your tool ships the file

Some tools attach a file to a script or a software package and copy it to the computer before running it. That is also the way to go when computers cannot reach your Blink address over HTTPS during the rollout, or your server uses its built-in certificate.

1. Download **Access agent** from **Instance** › **License** › **Agent builds**, or select **Agent** on the card Blink shows right after you create an enrollment key. The file is `blink-agent.exe`. To check it, right-click it, select **Properties** › **Digital Signatures**, and make sure the signer is **IZT Apps, Inc.**
2. Add it to your tool's package or script attachments.
3. Run it, from the folder the tool puts it in, with:

   ```bat
   blink-agent.exe --install --enroll <key>
   ```

A file you upload stays at the version you uploaded. That is fine for updates: the agent [updates itself](/install/agent-updates/) after it connects. Replace the uploaded file now and then, so new computers start on a recent version, and always download a fresh copy after your Blink address changes.

## Steps for each tool

The menus below are the ones these tools show at the time of writing; they change from time to time, so check your tool's own help if yours look different. The idea is always the same: add the PowerShell script, give it the address and key, run it as the system account on the computers you choose, and allow it a few minutes to finish.

Most tools let you store a value once per customer (a client, site or organization field). That is the best place for the enrollment key: one key per customer, and the same script for everyone.

Using **Kaseya 365**? Its endpoint management is Datto RMM or Kaseya VSA: follow the steps for the one you use.

### NinjaOne

1. Create a custom field for the key. Go to **Administration** › **Organizations** › **Organization Custom Fields**, select **+ Add custom field** › **Field**, and choose the **Secure** type. Give it a label such as `Blink Enroll Key` and note the **Name** NinjaOne fills in from it (for example `blinkEnrollKey`).
   - Make sure the field's **Inheritance** includes devices. Scripts run on the device and cannot read the field otherwise.
   - On the **Permissions** tab, set **Automations** to **Read Only**. Scripts cannot read a field without it.
2. Fill in the field on each organization with that organization's key. Leave it empty on locations and devices: a value there takes priority over the organization's.
3. Go to **Administration** › **Library** › **Automation** › **Add automation** › **New Script**. Set **Language** to **PowerShell**, the operating system to **Windows**, **Architecture** to **All** and **Run As** to **System**.
4. Paste the PowerShell script. In place of the "Lines for your tool" comment, add these lines, with the **Name** of your field:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = Ninja-Property-Get blinkEnrollKey
   ```

   `Get-NinjaProperty -Name blinkEnrollKey -Type Secure` is the newer equivalent and works too.
5. Run it on the devices: from a device's action menu select **Run Automation**, or select several devices under **Devices** and click **Run**. To cover new devices too, go to **Administration** › **Policies**, open the policy, select **Scheduled Automations** › **+Add automation**, add the script and schedule it with **Run once immediately**. That runs it on online devices when you save the policy, on offline devices when they come back online, and on devices added to the policy later.

NinjaOne counts any exit code other than `0` as a failure. Check the result in the device's **Activities** tab.

:::caution[Test with Run Automation, not the terminal]
NinjaOne hands secure fields only to a running automation. From the web terminal or a local terminal the key comes back empty, and the script stops with exit code `2`.
:::

### Datto RMM

1. Go to **Setup** › **Global Settings**. Under **Variables**, click **Add Variable** for each of these, then click **Save**:
   - **Name** `BLINK_ADDRESS`, **Value** your Blink address.
   - **Name** `BLINK_ENROLL_KEY`, **Value** a placeholder that is not a key, for example `none`.
2. For each customer, go to **Sites** › **All Sites** and click the site. Click **Settings** in the left menu and scroll to **Variables**. Click **Add Variable**, enter **Name** `BLINK_ENROLL_KEY` and that customer's key as the **Value**, tick **Masked** and click **Save**. Type the name exactly as above, including the capitals: a site variable only replaces the global one when the names match exactly. You cannot change **Masked** after saving.
3. Go to **Automation** › **Components** › **Create Component**. Choose the category **Scripts** and the script type **PowerShell**, and paste the PowerShell script unchanged. Datto RMM hands variables to PowerShell as environment variables, which the script reads. Set **Timeout this script if not completed within (seconds)** to at least `300`.
4. Under **Variables**, in **Global & Site**, select the global `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`. Datto RMM sends a component only the variables you select there, and each site's own `BLINK_ENROLL_KEY` replaces the global placeholder when the job runs. If your editor has no **Global & Site** section yet, skip this step: the component then receives all global and site variables. Do not add either name under **Component** variables: a component variable always wins, even when it is empty. Click **Create Component**.
5. Run the component as a **Quick Job** on the customer's devices (**Devices** › **All**, tick the devices, **Quick Job**). To catch new computers too, go to **Automation** › **Jobs** › **Create Job**, add the component, add the customer's sites as targets, choose **Initial Audit** under **Schedule**, and keep **Run as system account**.

Quick jobs always run as the local system account. A job shows **Success** when the script exits with `0`, and the script's messages appear under **StdOut/StdErr** in the job results.

:::caution
Never put a real key in the global `BLINK_ENROLL_KEY`. Every site without its own value receives the global one. With the placeholder, the job fails on those sites instead of enrolling their computers anywhere.

**Masked** hides the key in the console, but a computer with the agent's extended logging turned on writes masked values to its log file in clear text. Make sure extended logging is off on the computers you target.
:::

### N-able N-central

1. Save the PowerShell script as `install-blink.ps1`. N-central does not accept spaces in script file names.
2. Go to **Configuration** › **Scheduled Tasks** › **Script/Software Repository** and select **Add** › **Scripting**. Enter a **Name**, select **Browse** next to **File Name** and choose `install-blink.ps1`. Leave **Command Line Parameters** empty here, because every task that uses this script shares that value. Select **OK**.
3. Go to **Configuration** › **Scheduled Tasks** › **Add/Delete** and select **Add** › **Scripting**. Enter a **Task Name** that includes the customer's name, select **Use LocalSystem Credentials**, and choose the script you added to the repository. In **Command Line Parameters**, enter the address and that customer's key, separated by a space:

   ```
   https://yourname.onblink.cloud <key>
   ```

4. On the **Task Handler** tab, have the agent run the script. On the **Targets** tab, pick that customer's devices. On the **Schedule** tab, choose **Now**, **Once** or **Recurring** and set an **Execution Timeout** of at least 5 minutes. Select **Save**.
5. Repeat steps 3 and 4 for each customer, so each task uses its own key.

N-central does not check the script or its parameters before it runs the task, so try the task on one device first. If you target devices with a filter, N-central uses a snapshot of that filter, so devices added later are not included. To cover them, N-able recommends a scheduled task profile.

:::caution
**Command Line Parameters** is not a masked field. Anyone who can open the task can read the key, so use short-lived keys with a low **Max uses** and revoke them when the rollout is done.
:::

:::tip[Keep the key in a password property]
N-central can hold a masked value per customer in a custom property (**Administration** › **Custom Properties** › **Add** › **By Customers** › **Password Type**). Only Automation Manager policies can use it. Build a policy with a **Run PowerShell 5.1 Script** object, paste the PowerShell script, and add input parameters named `BlinkAddress` and `EnrollKey`. The script receives them as `$BlinkAddress` and `$EnrollKey`, so it needs no extra lines. When you add the task with **Configuration** › **Scheduled Tasks** › **Add/Delete** › **Add** › **Automation Policy**, set the `EnrollKey` input parameter to the custom property. N-able notes that this object handles password inputs as ordinary text once the script runs.
:::

If a task fails, the N-central agent writes the error code, for example `AG_ERR_REMO_043` with the return code, to `RemoteExecutionModule.log` or `agent.log` in its log folder on that computer. The script also prints the end of `C:\ProgramData\Blink\install.log` to the task output.

### N-able N-sight RMM

1. Save the PowerShell script, unchanged, as `install-blink.ps1`.
2. In the **All Devices** view, go to **Settings** › **Script Manager** and select **New**. In **Add User Defined Scripts**, enter a **Name**, set **Type** to **Automated Task**, choose Windows as the **OS**, and set **Default Timeout** (in seconds, at most `3600`) high enough for the download and install, for example `600`. Browse to `install-blink.ps1` and select **Save**.
3. In the client list, right-click the customer's client or site and select **Task** › **Add**. Select the script and select **Next**. When asked, choose servers, workstations or both.
4. Enter a task name. In **Command Line**, enter the address and the key, separated by a space:

   ```
   https://yourname.onblink.cloud <key>
   ```

5. In **Select Frequency Method**, choose **Manual** to run it now, or a schedule. Select **Next**, select the devices that should get the agent, and select **Add Task**.

Use a separate task for each customer, so each one uses its own key. The task runs with the account of the **Advanced Monitoring Agent** service, which is the local system account unless someone changed it. On computers that already have the agent, the script ends straight away, so running the task again is safe.

N-sight adds two arguments of its own (`-logfile` and a file name) after yours. The script reads only the first two, so leave it as it is and do not add a `param()` block.

:::caution[The key is stored in plain text]
N-sight has no protected field for task parameters, so the key is stored in plain text on the task. Give the key a short expiry and revoke it when the rollout is done.
:::

N-sight marks any exit code other than `0` as failed. It reserves codes `1` to `999` for its own scripts, so for the script's codes `1`, `2`, `20` and `21` the task shows as failed but the script's message may not show correctly. N-sight may also shorten the output, and results appear only after the device next checks in. Look at the exit code and [Check the rollout](#check-the-rollout).

### ConnectWise RMM

1. Create a custom field for the key. Go to **Settings** › **Custom Fields** › **Add Field +**. Name it `Blink_Enroll_Key` (letters, numbers and underscores only), set **Level** to **Company** (or **Site** if you use one key per site) and **Type** to **Text Box**, leave the default value empty, and mark the field as editable. Then, for each customer, go to **Clients** › **Companies**, select the company, open its **Custom Fields** tab and enter that customer's key.
2. Go to **Automation** › **Tasks** › **Add** › **Script Editor** and name the task. Every row you add needs an **Operating System**: choose **Windows**.
3. Click **Add Row** and choose **Set Pre-defined Variable**. Enter `Enroll_Key` as the variable name, choose **Custom Field** and select `Blink_Enroll_Key`.
4. Click **Add Row** and choose **PowerShell Script**. Set **Run As** to **System**, set **Expected time of script execution in seconds** to `600`, and tick **Continue on Failure** so the rows after it still run. Paste the PowerShell script, and in place of the "Lines for your tool" comment add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@Enroll_Key@'
   ```

   ConnectWise RMM replaces `@Enroll_Key@` with the key from the computer's company before the script runs.

5. Click **Add Row**, choose **Script Log** and enter `%output%` as the message, so the script's output shows in the task results.
6. Click **Add Logic**. Build the condition on **Output**, **Does not contain**, `Blink: the Access agent is`, and under it add a **Script Exit** row with the message `Blink: the install failed. See the output above.` Both of the script's success messages contain that text and none of its failure messages do, so a refused install shows as a failed task.
7. Click **Save**. Select the task and click **Schedule**. Choose **Run Now**, a schedule, or **Next Agent Check-In** for computers that are offline (a Run Now task on an offline computer fails by timeout). Click **Select Targets**, choose the companies, sites, device groups or devices, and click **Run**.

:::caution
ConnectWise RMM has no masked field type. Anyone whose role can view custom field values can read the key. By default that includes **Manager**, **Technician**, **Office Staff** and **Client Site Manager**. Revoke the key when the rollout is done.
:::

:::note
To type the key when you schedule the task instead, skip steps 1 and 3. Click **Add Parameter** in the Script Editor, name it `Enroll_Key` with the type **Text String**, and enter the key under **Schedule**, with a separate schedule for each customer. Parameter values show on the task's **Scheduling** tab.
:::

### ConnectWise Automate

1. Create a client-level extra data field (EDF) for the key, with **Field Type** **Text**, for example named `Blink Enroll Key`, and fill in each client's key.
2. Under **Automation**, pick a script folder and add a new script with **Target** set to **Computer**.
3. Add an **ExtraData Get Value** step. As **Extra Field**, pick your key field (the entry for the client level). Enter `%clientid%` as **ID** and `BlinkEnrollKey` as **Variable**, without `@` signs.
4. Add an **Execute Script** step from **Command Execution**. Set **Script Type** to **PowerShell Bypass**, so the computer's execution policy does not block it. Set **Script Credentials** to **Local Agent**, so it runs as the system account. Enter `BlinkResult` as **Variable**.
5. Paste the PowerShell script into the script box. In place of the "Lines for your tool" comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@BlinkEnrollKey@'
   ```

   Automate replaces `@BlinkEnrollKey@` with the client's key before the script runs.
6. Add a **Script Log Message** step with `@BlinkResult@`, so the script's `Blink:` lines show in the script log.
7. Save the script. Run it on one computer and check the script log, then run it on the client's computers or groups.

:::caution
Automate replaces `@name@` and `%name%` tokens anywhere in the script text. The Blink PowerShell script has none of its own, so do not add any when you edit it. Use the PowerShell script here, not the Command Prompt one.
:::

:::tip
If the install fails, check that the client's field is filled in, that the **Extra Field** and **ID** in step 3 match a client-level field, and that the variable name is spelled the same in steps 3 and 5. If you mark the key field as masked, test on one computer first to make sure the key still reaches the script.
:::

To ship the file instead, put `blink-agent.exe` in the `LTShare\Transfer` folder on your Automate server. Add a **File Download** step that saves it to the computer, for example as `C:\Windows\Temp\blink-agent.exe`. Then add a **Process Execute** step with that path as **File**, `--install --enroll @BlinkEnrollKey@` as **Arguments**, and **Wait for Process**.

### Kaseya VSA 10

Kaseya VSA 10 was formerly called VSA X. You keep each customer's key in an organization custom field and run the [PowerShell script](#the-powershell-script) from the Automation Hub.

1. Create the custom field. Go to **Automation** › **Custom Fields** and click **Create Custom Field**. Enter a **Display Name** such as `BlinkEnrollKey`, set **Type** to **Text**, select only **Organization** under **Contexts**, leave **Expires** off, and click **Create**.
2. Fill in each customer's key. Go to **Configuration** › **Organizations** and select the organization. On the **Custom Fields** tab, click **Edit**, then **Assign Custom Field**. Pick the field, choose **Enter manually**, paste that customer's key, click **Add**, then **Save**.
3. Go to **Automation** › **Automation Hub**, select a folder under **User Defined**, open the **Scripts** tab and click **Create Script**. Give it a **Name**.
4. Under **Inputs**, click **+ New** and add two variables, clicking **Save Variable** after each. The names must match exactly, because the script reads them by name:
   - **Name** `BlinkAddress`, **Variable Type** **Text**, **Default Value** your Blink address.
   - **Name** `EnrollKey`, with **Use custom field value** turned on and the field from step 1 selected as the **Custom Field**.
5. In the **Windows** section, turn on **Enable** and keep the **Script type** as **PowerShell**. Paste the PowerShell script into the editor below the input lines VSA 10 adds at the top, then click **Create** (**Save** when you edit an existing script). VSA 10 hands each input to the script as a PowerShell variable with the same name, so `$BlinkAddress` and `$EnrollKey` are already set and you need no lines in place of the "Lines for your tool" comment.
6. Go to **Devices** › **Device Management**, select the customer's computers, and choose **Actions** › **Run Script**. Pick the script, click **Next**, choose **Run now** and click **Run**. If VSA 10 asks you to confirm, tick the box and click **Confirm**. Scripts started this way run as System. Follow progress with **Bulk Action History** at the top of the page. To run the script on a schedule, add it to a task on the **Tasks** tab of the Automation Hub.

If the job output shows `Blink: set the Blink address and the enrollment key.`, an input did not arrive. Check that the input names are exactly `BlinkAddress` and `EnrollKey`, and that the organization has a value for the custom field.

:::caution[The key is not hidden]
VSA 10 custom fields have no secure or password type, so the key is stored as plain text and other VSA 10 users can see it. Revoke the key when the rollout is done.
:::

:::note[Shipping the file instead]
To push `blink-agent.exe` from VSA 10 rather than download it, upload it on the **Managed Files** tab of a **User Defined** folder in the Automation Hub with **Upload File**. Then build a workflow with a **Write File** action, which copies the file to `C:\ProgramData\Kaseya\VSAX\Working`. Add an **Execute PowerShell Command** action that runs `& "C:\ProgramData\Kaseya\VSAX\Working\blink-agent.exe" --install --enroll <key>` as System, not as the current user. Finish with a **Delete File** action. The key in that command is plain text too. Each workflow action stops after 30 minutes.
:::

:::tip
Don't run the script from a Client Portal troubleshooter. Troubleshooters run scripts as the logged-in user, not as System.
:::

### Kaseya VSA 9

These steps are for the classic VSA (9.x) **Agent Procedures**. Run the PowerShell script as a file. Do not paste it into a step: VSA reads `<`, `>` and `#` in a step's fields as variable markers, and the script contains all three.

1. Save the PowerShell script unchanged as `install-blink.ps1`. You do not need to add any lines, because the procedure passes the address and key as arguments. Go to **Agent Procedures** › **Manage Procedures** › **Schedule / Create**, click **Manage Files**, choose **Shared files** and upload it. If VSA refuses the file, add the `.ps1` extension under **Server Management** › **Default Settings**.
2. Click **Manage Variables**. Select **&lt;New Variable&gt;**, name it `BlinkEnrollKey` (names are case sensitive) and choose **Public** if other VSA users will run the procedure. Only master role users can create public variables. Enter one customer's key in **Set Variable Value**, tick that customer's group IDs and click **Apply**. Repeat for each customer.
3. Select a folder, click **New Procedure** and add these steps in order:
   - **getVariable()**: choose **Secure Agent Working Directory Path** and store it in a variable named `blinkdir`.
   - **writeFile()**: write the uploaded `install-blink.ps1` to `#blinkdir#\install-blink.ps1`.
   - **executePowerShell64BitSystem**: use `#blinkdir#\install-blink.ps1` as the file, `https://yourname.onblink.cloud <BlinkEnrollKey>` as the arguments, and turn on the option that sends the output to a variable.
   - **writeProcedureLogEntry()**: enter `#global:psresult#`, so the script's `Blink:` lines appear in the machine's **Agent Procedure Log**.
4. Select the procedure. On the **Schedule** tab, tick the machines and click **Run Now** or **Schedule Procedure**. Run it only on machines whose group has a `BlinkEnrollKey` value.

:::caution[The key is not hidden]
VSA 9 has no secret variable type. Users who open **Manage Variables** see the key in plain text for the groups they administer. Revoke the key when the rollout is done.
:::

:::note
VSA's help does not say whether the script's exit code marks the step as failed, so check the `Blink:` line in the log, not only the procedure status. When VSA runs PowerShell as System, it sets the computer's LocalMachine execution policy to **Unrestricted**. To change it back, add a final step that runs `Set-ExecutionPolicy` with your usual value.
:::

To [ship the file](#if-your-tool-ships-the-file) instead, upload `blink-agent.exe` with **Manage Files** and use **writeFile()** to copy it to `#blinkdir#\blink-agent.exe`. Then use **executeFile()** on that path with the arguments `--install --enroll <BlinkEnrollKey>`, run it as the system account, and have the procedure wait until it completes.

### Atera

1. Go to **Admin** › **Monitoring and automation** › **Scripts** and click **+ Create script**. Enter a **Script Name** and **Script description**, and set **File type** to **.ps1**.
2. Click **More script properties**. Leave **Run as** on **System** and **Arguments** empty, and don't set **Max script run time (minutes)** below 5.
3. Paste the PowerShell script into the script editor. In place of the "Lines for your tool" comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{[EnrollKey]}'
   ```

   `{[EnrollKey]}` is an Atera script variable: Atera puts the value you give it into the script text before it runs. Click **Create**.
4. Go to **Customers**, open the customer and go to the **Devices** tab. Select the devices and click **Run script**. Choose how long to queue the script for devices that are offline, pick the script, and paste that customer's key when Atera asks for the `EnrollKey` value.

To run it on a schedule instead, add the script to an automation profile under **Admin** › **Monitoring and automation** › **Patch management and IT automation**, set the `EnrollKey` value in the profile, and assign the profile to the customer. The value is saved in the profile, so use a separate profile for each customer.

To check a manual run, go to **Reports** › **General** › **Recent Processes**, expand the customer and click the info icon to see the script output with the Blink messages. Results from automation profiles are not in that report; see **Reports** › **Classic Reports** › **Patch & Automation Feedback**.

:::caution
Atera has no secret or masked script variable, so the key is stored and shown as plain text. Revoke it when the rollout is done.
:::

You can also upload `blink-agent.exe` with **Upload script** on the same page and put `--install --enroll <key>` in **Arguments** (see [If your tool ships the file](#if-your-tool-ships-the-file)). The key is then part of the script's settings, so you need one upload per customer. On the Pro plan, uploaded .exe files can be at most 20 MB.

### Syncro

1. Create a custom field for the key. Go to **Admin**, and under **Customers** select **Customer Custom Fields** › **New Field**. Name it `Blink Enroll Key`, set **Field Type** to **Text Field** and click **Create Field**. Then fill in each customer's key on that customer's record. (Syncro is renaming Customers to Organizations, so some screens may say Organization instead.)
2. Go to **Scripts** › **+New Script**. Set **File Type** to **PowerShell**, **Run As** to **System**, and **Max Script Run Time (minutes)** to at least `5`.
3. Click **Add Script Variable** and add a variable named `EnrollKey` of type **Platform**. For its value, choose `{{customer_custom_field_blink_enroll_key}}`. Syncro builds this name from the field name in lower case, with spaces turned into underscores, so it must match the field you created. When the script runs, `$EnrollKey` holds the key of the asset's customer.
4. Paste the PowerShell script. In place of the "Lines for your tool" comment, add only the address:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   ```

   Do not set `$EnrollKey` in the script. It comes from the variable. Do not use a **Runtime** variable for the address either: Syncro asks for runtime values every time someone schedules the script.
5. Click **Create Script**. To run it, open an asset's **Scripts** tab, click **+Add to Queue** and choose **System** under **Run As**. For several assets at once, tick them and choose **Run Script…** from **Bulk Actions**. To cover new computers too, add it to a policy's **Scripting** category as a **Setup Script** or under **Script Schedules**.

Each run's result and output are in the asset's **Scripts** tab under **Script History**. The script returns the agent's exit code, and Syncro uses a non-zero code to flag the run as failed. On a failure the output includes the end of `install.log`.

:::caution
Syncro custom fields have no masked type, so anyone who can open the customer in Syncro can read the key. Give each key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done.
:::

:::tip
If the computers cannot download from your Blink address, use the [file directly](#if-your-tool-ships-the-file). In **Scripts**, click **Add New File** and upload `blink-agent.exe`. Then edit the script, click **+Add Required File**, choose the file, and in **Destination File Name** enter a full path that ends in the file name, for example `C:\Windows\Temp\blink-agent.exe`. Keep the `EnrollKey` variable and use this script instead:

```powershell
$p = Start-Process -FilePath 'C:\Windows\Temp\blink-agent.exe' -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru
exit $p.ExitCode
```
:::

### SuperOps

1. Create a client custom field for the key, for example **Blink Enroll Key**: go to **Settings** › **Advanced Configuration** › **Manage Fields**, open the client fields and select **+ Create**. Fill in each customer's key under **Additional properties** on that client's profile.
2. Go to **Modules** › **Scripts** and select **+Script**. Set the language to **PowerShell**, set **Run as** to the system (root) user rather than the logged-in user, and set **Script timeout** to at least 5 minutes.
3. Select **+ Add placeholder variables**, enter `BlinkCustomerKey` as the name, and pick your **Blink Enroll Key** client field from the dropdown.
4. Paste the PowerShell script. In place of the "Lines for your tool" comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = "$BlinkCustomerKey"
   ```

5. Save the script. Run it from **Modules** › **Assets** (tick the customer's computers and select **Run script**), or add it to a policy so new computers get the agent too.

:::caution[Variable names in SuperOps]
SuperOps fills in `$BlinkCustomerKey` wherever that name appears in the script. Keep the double quotes, because SuperOps does not fill in a name inside single quotes. Do not name a SuperOps variable `BlinkAddress`, `EnrollKey` or any part of those names, because SuperOps would also replace the script's own variables and break it.
:::

If you would rather type the key when you run the script, select **+ Add run time variables** with the same name instead of a placeholder variable. SuperOps asks for the value each time you run the script, or once when you add it to a policy.

SuperOps has no secure script variable, so treat the client field as readable by your team and revoke the key when the rollout is done.

### Action1

Action1 runs scripts as the Local System account. You add the script to your **Script Library** once, then run it in each customer's organization with that customer's key.

1. Go to **Configuration** › **Script Library** and select **New Script**. Enter a name, then on the **Script** step set the language to PowerShell and paste the PowerShell script.
2. Replace the line `# >>> Lines for your tool go here (see the steps for your tool). <<<` with these two lines. Action1 hands parameters to PowerShell scripts as variables named after the parameter:

   ```powershell
   $BlinkAddress = "$BLINK_ADDRESS"
   $EnrollKey    = "$BLINK_ENROLL_KEY"
   ```

3. In the **Parameters** section, select **Add parameter** and add `BLINK_ADDRESS` and `BLINK_ENROLL_KEY`, both of type **String**. Give `BLINK_ADDRESS` your Blink address as its default value. Do not put a real key in the default value of `BLINK_ENROLL_KEY`: Script Library scripts are available to every Action1 user in your enterprise who can use scripts.
4. Leave the script's exit codes empty. Action1 uses the codes you enter there to decide when to restart the computer, not to decide whether the script worked.
5. On the **Test** step you can run the script on one computer with a key typed in. This really installs the agent and enrolls that computer, so only test on a computer of the customer whose key you use. Then finish the wizard.
6. For each customer, switch to that customer's organization at the top of the **Endpoints** page, select the computers and select **Run Script**. Pick the script from the Script Library, enter that customer's key as `BLINK_ENROLL_KEY`, and in the reboot options choose **Do not reboot automatically**. To reach computers that are offline right now, schedule the run instead of running it now, and set an **Automation completion deadline** under **Missed schedule retry and maintenance window**.
7. Check the result under **Automations** › **History**. The job output shows the script's messages, and on a failure the end of the agent's install log.

If you prefer the Command Prompt script, set the language to CMD and add the same two **String** parameters. Action1 passes CMD parameters as environment variables, which the script reads, so you can paste it as is: its two `set` lines only fill in values that are missing.

:::caution
Action1 has no hidden or password parameter type, so the key is stored and shown as plain text. Give each customer's key a **Max uses** that fits the rollout and a short expiry, and revoke it when you are done.
:::

:::note
If your Action1 enterprise uses Endpoint Takeover Prevention, an Enterprise Admin must sign the script and the automations that run it with their Action1 Key, or computers block them. If your enterprise requires signed PowerShell scripts, sign the script after adding the two lines and upload the file instead of pasting it.
:::

:::tip
Use the script rather than a **Software Repository** package. Action1 recognizes a package by its display name in the computer's installed apps, and the Access agent does not add itself there, so Action1 cannot tell whether it is installed.
:::

### Level

1. Go to **Workspace** › **Custom Fields** and select **+ Add custom field**. Name it, for example, `blink_enroll_key`, leave **Field value** empty, turn on **Admin only**, and select **Add custom field**. Admin only hides the value in the web interface from everyone except account administrators. Scripts can still use it.
2. Set the key for each customer on their group. Go to **Devices**, select the customer's group, open **Custom fields**, select **⋮** › **Edit** on the field, enter the key in **Field value** and select **Update custom field**. Level uses the most specific value it finds: device, then group, then the global value. Do not put a key in the global value, or every customer would enroll into the same Blink organization.
3. Go to **Scripts** and select **+ Create script**. Set the language to **PowerShell**, **Run as** to **Local system**, and **Timeout (in seconds)** to at least `600`. The default is 100 seconds, and a script that runs longer is marked as failed.
4. Paste the PowerShell script. In place of the "Lines for your tool" comment, add the lines below. Insert the field with the **{x}** button in the editor so its name matches exactly. If a group has no key, Level leaves the placeholder in place, which the script treats as missing: it stops with exit code `2`. Then select **Save script**.

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{{cf_blink_enroll_key}}'
   ```

5. Go to **Automations**, select **+ Create automation**, add the **Run script** action (under **System**) and pick your script. Add a trigger, or use **Add a device** to run it on the computers you choose. To try it on a few computers first, select them in the device list and choose **Actions** › **Run saved script**. Level asks you to approve that run before it starts.

Level marks the step as failed when the script exits with any code other than `0`. To read the script's output, open the run on the automation's **History** tab and expand the step. Computers that are offline run the automation when they next come online.

### Tactical RMM

Tactical RMM runs scripts as SYSTEM with Windows PowerShell. It has no masked field type, so keep the key in a client custom field and pass it as an environment variable. Tactical RMM does not log environment variables, while **Script Arguments** end up in the computer's PowerShell event log.

1. Go to **Settings** › **Global Settings** › **Custom Fields** and select **Add custom field**. Set **Target** to **Client**, **Name** to `BlinkEnrollKey` and **Field Type** to **Text**, then select **Submit**. Leave **Hide in Dashboard** clear: it hides the field from the client form where you enter the key.
2. For each client, right-click it in the client tree, select **Edit**, enter its key under **Custom Fields** and select **Save**. Anyone who can edit the client can see the key.
3. Go to **Settings** › **Script Manager** › **New** › **New Script**. Set **Shell Type** to **Powershell** and paste the PowerShell script. Change its last line from `exit $code` to:

   ```powershell
   $host.SetShouldExit($code); exit $code
   ```

   Tactical RMM reports a plain `exit` with any code other than 0 as 1. This line passes the agent's real exit code through, for example 20 or 21. The script's earlier exits, including `exit 2`, still show as 1, which still counts as a failure.
4. In **Environment vars**, type each of these lines and press Enter after each one:

   ```
   BLINK_ADDRESS=https://yourname.onblink.cloud
   BLINK_ENROLL_KEY={{client.BlinkEnrollKey}}
   ```

   The name between `{{ }}` is case sensitive and must match the custom field exactly. If a client's field is empty, Tactical RMM leaves the variable out. The script then prints "Blink: set the Blink address and the enrollment key." and Tactical RMM shows exit code 1.
5. Set **Timeout (seconds)** to `600`. With the default of 90 seconds, the job can be stopped during the download or install, and Tactical RMM then reports exit code 98.
6. Leave **Run As User (Windows only)** clear, so the script runs as SYSTEM, and select **Save**.
7. Run it: right-click an agent and select **Run Script**, or use **Tools** › **Bulk Script** for a client or site. Leave **Run As User** clear there too. To reach new computers as they are added, go to **Settings** › **Automation Manager** and add the script to a policy as a task with **Task run type** set to **Onboarding**.

:::note
The run forms and new tasks copy the script's environment vars and timeout when you pick the script. A task you added earlier keeps its old values. **Run Script** with **Wait for Output** shows the script output and the **Return Code**. Runs from **Bulk Script** and tasks are listed on the agent's **History** tab.
:::

### Pulseway

Pulseway has no secret or password-type field: custom fields and script variables are plain **Text**, **Number**, **Date** or **Boolean**. Keep the key in a custom field rather than in the script text, and revoke it when the rollout is done.

1. Go to **Automation** › **Custom Fields** and create a **Text** custom field for the key, for example `BlinkEnrollKey`, with the **Organization** context. Set its value on each customer organization. A value set on a computer itself takes priority over the organization's, so leave it empty at that level.
2. Go to **Automation** › **Automation Hub**, open **User Defined** (or a folder in it) and select **Create Script**.
3. Enable the script for **Windows**, choose **PowerShell** and paste the PowerShell script.
4. Add an input variable named `EnrollKey` (no `$`), of type **Text**, and bind it to your key field. Pulseway adds a line such as `$EnrollKey = '...';` at the top of the script for you.
5. In place of the "Lines for your tool" comment, add only the address:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   ```

6. Save the script. To test it on one computer, select the computer in **Device Management** and use **Action** › **Run Script**. For the rollout, create a task on the **Automation Hub** page with a scope that covers the customer's computers.

Pulseway marks a script as failed when it exits with a code other than `0`, so a refused install shows as failed, with the script output. A computer whose organization has no key value exits with code `2`.

:::caution[PowerShell User Impersonation]
Pulseway runs scripts as the system account by default. If **PowerShell User Impersonation** is turned on for a computer (Pulseway Manager › **Settings** › **Runtime**), PowerShell scripts run as the configured user instead. That user must be a local administrator for the install to work.
:::

### LogMeIn Resolve

LogMeIn Resolve was called GoTo Resolve until 2025.

1. Go to **Devices** › **Remote Execution** and select **Create new job**.
2. Under **Scripting**, add a **PowerShell execution** step and paste the PowerShell script. In place of the "Lines for your tool" comment, set `$BlinkAddress` and `$EnrollKey`.
3. Choose the customer's devices. Turn on **Retry job for offline devices** to catch computers that are switched off, then select **Run**.

Scripts run as the system account, and each step may take up to two hours. The key is part of the script text, so give it a **Max uses** close to the number of computers and a short expiry. If a device shows **Job failed**, select **View logs**: the script prints the reason on a line starting with `Blink:`.

### ManageEngine Endpoint Central

The menus are the same in Endpoint Central MSP. Use one configuration per customer, each with that customer's enrollment key.

1. Save the PowerShell script as `install-blink.ps1`. Go to **Configurations** › **Script Repository** › **Add Script** and upload it. Type the file name yourself rather than pasting it.
2. Go to **Configurations** › **Add Configurations** › **Windows Configuration** › **Custom Script** › **Computer Configuration**.
3. Choose **Repository** and pick `install-blink.ps1` in **Script Name**.
4. In **Script Arguments**, enter the address and the key, separated by a space and without quotes:

   ```
   https://yourname.onblink.cloud <key>
   ```

   Select **Mask Sensitive Data** so the key is hidden from end users during deployment.
5. Leave **Exit codes** at `0`, so any other code shows as failed.
6. Set **Frequency** to **Once** and select **Enable logging for troubleshooting**. The script's output, including the end of the install log on a failure, then shows in **Remarks**.
7. Set **Run As** to **System user**.
8. Define the targets and click **Deploy Immediately**.

Check the result per computer under **Execution Status** and **Remarks**. By default, Endpoint Central gives a script 60 minutes and then reports **The wait operation timed out - Error Code: 258**.

:::caution
**Mask Sensitive Data** hides the key from end users, but console users with the right scope and role can still see it through **View Script**. Never type the key into the script itself.
:::

You can also deploy the file as a software package (see [If your tool ships the file](#if-your-tool-ships-the-file)). Go to **Software Deployment** › **Package Creation** › **Packages** › **Add Package** › **Windows**, choose the package type **EXE/APPX/MSIEXEC/MSU/MSIX/MSIX Bundle**, select **From Local Computer** and upload `blink-agent.exe`. In **Installation Command with Switches/Arguments**, enter:

```bat
blink-agent.exe --install --enroll <key>
```

Under **Advanced Settings**, make sure **Exit Code** lists `0`. Deploy it from **Software Deployment** › **Deployment** › **Install/Uninstall Software** › **Windows** › **Computer Configuration**, with **Install As** set to **System User**, and click **Deploy Immediately**. **Deploy** waits for the next 90-minute refresh cycle or startup. The key is part of the package command, so create one package per customer.

### Automox

Use a Worklet, not a Required Software policy: the agent does not appear in the list of installed programs, which is what a Required Software policy checks.

1. Go to **Settings** › **Secrets & Keys**, select **Add Secret**, and save the customer's key as a secret, for example named `Blink enroll key`.
2. Go to **Automate** › **Policies** › **Create Policy**, and in the Worklets section choose **Windows**. Enter a **Policy Name**.
3. Under **Inputs**, select **Add Input**. Set **Variable Name** to `BLINK_ENROLL_KEY` and choose your secret in **Select Organization Secret**.
4. In **Scope**, put this in the evaluation code. It tells Automox to install only where the agent is not running:

   ```powershell
   $s = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
   if ($s -and $s.Status -eq 'Running') { exit 0 } else { exit 1 }
   ```

5. Paste the PowerShell script into the remediation code. In place of the "Lines for your tool" comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = $BLINK_ENROLL_KEY
   ```

6. Set a **Schedule**, use **Associate Groups** to pick the customer's groups, and select **Create Policy**.

Worklets run as the system account in 32-bit PowerShell, which the script handles. When you run the policy by hand, Automox skips the evaluation code and runs the remediation code directly, which is safe: the script does nothing on computers that already run the agent.

### JumpCloud

1. Go to **Settings** › **Automation Variables** and select **+Variable**. Name it, for example, `blink_enroll_key`, choose the **String** data type, paste the customer's key as the **Value**, and turn on **Secret Variable**. Create it in each customer's organization.
2. Go to **Device Management** › **Commands**, select **+ Command** › **Command**, set **Type** to **Windows** and set the command to run as PowerShell.
3. Paste the PowerShell script into **Command**. In place of the "Lines for your tool" comment, add:

   ```powershell
   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = {{blink_enroll_key}}
   ```

   Do not put quotes around `{{blink_enroll_key}}`: JumpCloud adds them when the command runs.
4. Set **Timeout After** to at least `300` seconds.
5. On the **Device Groups** or **Devices** tab, choose the customer's computers, select **Save**, then **Run Now**.

Commands run as the system account in a 32-bit process, which the script handles.

### ImmyBot

ImmyBot uploads the file itself and hands each customer's key to the install script from a tenant license.

1. Go to **Library** › **Software** › **New**. Set **Installer Type** to **File**, choose **Full Installer Package**, and upload `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)).
2. Name the software, for example `IZT Blink Access agent`, and enter the uploaded file's version as the **Version String**.
3. For the detection method, choose a custom detection script that runs as **System**:

   ```powershell
   $exe = Join-Path $env:ProgramData 'Blink\blink-agent.exe'
   if ((Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue) -and (Test-Path $exe)) {
       (Get-Item $exe).VersionInfo.ProductVersion
   }
   ```

   The agent does not appear in the list of installed programs, so detection by display name does not find it.
4. Under **Installation**, select **New**, set the execution context to **System**, and use:

   ```powershell
   $p = Start-Process -FilePath $InstallerFile -ArgumentList '--install', '--enroll', $LicenseValue -Wait -PassThru -NoNewWindow
   if ($p.ExitCode -ne 0) { throw "Blink: the install failed with exit code $($p.ExitCode)." }
   ```

5. Make the software require a license, and add a license key for each tenant that holds that customer's enrollment key. ImmyBot passes it to the install script as `$LicenseValue`.
6. Go to **Deployments** › **New**, choose **Software** and this software, set the enforcement to **Required**, and target **Single Tenant** with that customer's computers. The deployment applies the next time a maintenance session runs.

The agent [updates itself](/install/agent-updates/), so the installed version soon becomes newer than the one you uploaded.

### Microsoft Intune

Intune runs the PowerShell script as a Win32 app. Win32 apps have no script variables or per-customer fields, so the address and key go into the install command. Create one app for each customer tenant, or for each enrollment key. Win32 apps need Windows Pro, Enterprise or Education.

1. Save the PowerShell script as `install-blink.ps1` in an empty folder, for example `C:\BlinkPackage`. Wrap it into an `.intunewin` file with the Microsoft Win32 Content Prep Tool:

   ```bat
   IntuneWinAppUtil.exe -c C:\BlinkPackage -s C:\BlinkPackage\install-blink.ps1 -o C:\BlinkOutput
   ```

   Keep `IntuneWinAppUtil.exe` itself out of that folder, because everything in the folder goes into the package.
2. In the Microsoft Intune admin center, go to **Apps** › **All Apps** › **Create**. Choose the **Windows** platform, then **Windows app (Win32)**, and click **Select**. Click **Select app package file** and upload the `.intunewin` file.
3. On **Program**, set:
   - **Installer type**: **Command line**.
   - **Install command**:

     ```bat
     %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File install-blink.ps1 https://yourname.onblink.cloud <key>
     ```

     Keep the `Sysnative` path. A plain `powershell.exe` in this field starts 32-bit PowerShell.
   - **Uninstall command**: `"C:\ProgramData\Blink\blink-agent.exe" --uninstall`. Intune does not expand environment variables in this field, so keep the full path.
   - **Install behavior**: **System**.
   - Leave the return codes as they are. `0` is **Success**. Any exit code that is not on the list, such as `1`, `2`, `20` or `21`, shows as a failed install.
4. On **Requirements**, set **Operating system architecture** to x64 and **Minimum operating system** to the oldest Windows 10 or 11 release you support.
5. On **Detection rules**, choose **Manually configure detection rules** and add a **Registry** rule:
   - **Key path**: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent`
   - **Value name**: leave empty.
   - **Detection method**: **Key exists**.
   - **Associated with a 32-bit app on 64-bit clients**: **No**.
6. On **Assignments**, under **Required**, select **Add group** and choose a group with the customer's devices. Then click **Create** on **Review + create**.

:::caution
Anyone who can view the app in Intune can see the key in the install command, and the Intune Management Extension logs in `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs` on each computer can contain it too. Give the key a **Max uses** close to the number of computers and a short expiry, and revoke it when the rollout is done.
:::

If an install shows as failed, open `C:\ProgramData\Blink\install.log` on the computer to see why. `AppWorkload.log` in the folder above shows the exit code Intune received.

### Microsoft Configuration Manager

Configuration Manager installs the agent as an application. You do not need the script: use the file directly (see [If your tool ships the file](#if-your-tool-ships-the-file)).

1. Put `blink-agent.exe` in a folder of its own on a network share that the site server's computer account can read.
2. In the Configuration Manager console, go to **Software Library** › **Application Management** › **Applications** and select **Create Application**. Choose **Manually specify the application information** and give it a name.
3. On the **Deployment Types** page, select **Add**, set **Type** to **Script Installer** and choose **Manually specify the deployment type information**.
4. On the **Content** page, set:
   - **Content location**: the folder from step 1.
   - **Installation program**: `blink-agent.exe --install --enroll <key>`
   - **Uninstall program**: `"C:\ProgramData\Blink\blink-agent.exe" --uninstall`

   Leave **Run installation and uninstall program as 32-bit process on 64-bit clients** cleared.
5. On the **Detection Method** page, select **Add Clause** and add a **Registry** rule: **Hive** `HKEY_LOCAL_MACHINE`, **Key** `SYSTEM\CurrentControlSet\Services\BlinkAgent`, with no value, so the key only has to exist.
6. On the **User Experience** page, set **Installation behavior** to **Install for system**, **Logon requirement** to **Whether or not a user is logged on**, and **Installation program visibility** to **Hidden**.
7. Finish the wizard, distribute the content to your distribution points, and deploy the application to a device collection with the purpose **Required**.

The default return codes of a Script Installer count only `0` as success (plus the restart and retry codes), so `1`, `20` and `21` show as failed. The key is part of the installation program, which every console user who can read the application can see, so give it a **Max uses** close to the number of computers and revoke it when the rollout is done.

### Group Policy

Use the Command Prompt script as a computer startup script. Group Policy has no secure field, so the key goes in the script file itself.

1. Save the Command Prompt script as `install-blink.cmd`, with your Blink address and the enrollment key filled in on the two `set` lines.
2. In **Group Policy Management**, right-click the organizational unit that holds the computers (not the users) and select **Create a GPO in this domain, and Link it here**. Name it, then right-click the new Group Policy Object and select **Edit**.
3. Go to **Computer Configuration** › **Policies** › **Windows Settings** › **Scripts (Startup/Shutdown)** and double-click **Startup**.
4. Select **Show Files** and copy `install-blink.cmd` into the folder that opens. The file is then stored with the Group Policy Object, where the computers can read it at start-up.
5. Back in **Startup Properties**, select **Add**, then **Browse**. Pick `install-blink.cmd` from that same folder, then select **OK** in both dialogs.

Startup scripts run as the local system account when the computer starts, so each computer needs a restart. By default Windows applies Group Policy in the background while it starts, so a computer may need more than one restart before it runs the script. To make computers wait for the network and apply the policy on the first restart, enable **Always wait for the network at computer startup and logon** under **Computer Configuration** › **Policies** › **Administrative Templates** › **System** › **Logon**. A computer that is off the company network when it starts does not run the script. It runs it at a later restart on the network.

On computers that already run the agent, the script ends straight away, so it does no harm on later restarts.

By default Windows gives all Group Policy scripts together 10 minutes, then stops them. If you already run other long startup scripts, enable **Specify maximum wait time for Group Policy scripts** under **Computer Configuration** › **Policies** › **Administrative Templates** › **System** › **Scripts** and raise the time.

Group Policy does not show you whether the install worked. Use [Check the rollout](#check-the-rollout) to see which computers enrolled.

:::caution
The script, with the key, is stored in SYSVOL. By default every user in the domain can read it, and so can anyone with administrator rights on a domain computer. Give the key a **Max uses** close to the number of computers and a short expiry. When the rollout is done, remove the script in **Startup Properties**, delete the file in **Show Files** (**Remove** only takes it off the list) and revoke the key.
:::

### PDQ Deploy and PDQ Connect

You do not need the script. Both tools copy an EXE to the computer and run it with your parameters. First download `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)).

**PDQ Deploy**

1. Select **New Package** on the toolbar (or **File** › **New Package**) and give the package a name that includes the customer. A new package has no steps yet.
2. Select **New Step** › **Install**. Set **Install File** to `blink-agent.exe` and **Parameters** to `--install --enroll <key>`.
3. Leave **Success Codes** as they are. The defaults are `0`, `1641` and `3010`, so the agent's `1`, `2`, `20` and `21` show as errors with the code. Save the package.
4. Select **Deploy Once**, add the customer's computers with **Choose Targets**, then select **Deploy Now**. The package runs as your Deploy User, which must be an administrator on the computers. There is no need to change **Run As**.

**PDQ Connect**

1. Go to **Packages** › **Create package** and name it.
2. Select **Add install step**, then **Attach installer file** and choose `blink-agent.exe`. In **Parameters**, enter `--install --enroll <key>`.
3. Check that **Success codes** does not list `1`, `2`, `20` or `21`, so those show as failed. Then select **Save**.
4. On the **Packages** page, select the package, then **Actions** › **Deploy**. Choose the customer's devices and select **Deploy**.

:::caution
The key is stored in plain text in the package's **Parameters**. PDQ Deploy also shows it in the step's **Command Line**. Anyone who can open the package, or an exported copy of it, can read the key. Make one package per customer (one per enrollment key), and revoke the key when the rollout is done.
:::

## Switch from your old remote access tool

Put Blink on first, and remove the old tool only once each computer shows **online** in Blink, so you never lose access in between.

1. Roll out the Access agent with the steps above, or [through the old tool itself](#use-the-old-tool-to-install-blink).
2. In Blink, open **Access** in each organization and check that every computer shows **online**. See [Check the rollout](#check-the-rollout).
3. Remove the old tool from those computers.
4. If your RMM tool installs a remote access tool of its own (for example Splashtop or AnyDesk), turn that integration off in the RMM, or it may install the tool again.

### Use the old tool to install Blink

**ConnectWise ScreenConnect.** Its Access agents run commands as the system account:

1. On the host page, open **Access** and tick the sessions of one customer.
2. Right-click them and select **Run Command**.
3. Enter these three lines, then the PowerShell script, with `$BlinkAddress` and `$EnrollKey` set in place of the "Lines for your tool" comment:

   ```
   #!ps
   #timeout=300000
   #maxlength=100000
   ```

   `#!ps` sends the command to PowerShell, `#timeout` gives it 5 minutes instead of the default 10 seconds, and `#maxlength` keeps the whole output.
4. Read each session's output: the last line starts with `Blink:` and says what happened.

ScreenConnect keeps the command, key included, in the session history and the audit log, so revoke the key when the rollout is done.

**Splashtop.** With Splashtop Autonomous Endpoint Management (AEM), go to **Automation** › **Scripts & Tasks** and select **Create Action** › **Batch/Executable File**. Upload `blink-agent.exe` (see [If your tool ships the file](#if-your-tool-ships-the-file)), enter `--install --enroll <key>` in **Parameters**, then select **Save and Run**, choose the customer's computers and enter an administrator account for them. Use one action per customer.

### Remove the old tool

| Tool | How to remove it |
|---|---|
| ConnectWise ScreenConnect | On the host page, select the sessions, then **Uninstall** › **Uninstall and Delete**. **Delete** on its own leaves the client on the computer. |
| AnyDesk | `"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --silent --remove` |
| Splashtop Streamer | Uninstall it silently with `msiexec /qn /x` and the Streamer's product code, as described in Splashtop's own help. |
| TeamViewer | Use your TeamViewer management console or TeamViewer's documented uninstall. Test any silent uninstall command on one computer first. |

## Check the rollout

- In Blink, open **Access** in each organization. Enrolled computers appear with their name, OS and agent version, and show **online** once the service connects. See [Manage Access devices](/use/manage-devices/).
- In your tool, look at the job results. Anything other than exit code `0` needs a look:
  - `1`: read the job output (the PowerShell script prints the end of `install.log`), or `C:\ProgramData\Blink\install.log` on the computer. Common causes: the computer cannot reach your Blink address, a security tool blocked the download, the key is wrong, used up, expired or revoked.
  - `2`: the script did not receive the address or the key. Check the variable or field for that customer.
  - `20`: every Access device in your plan is in use. Free one or add devices to your plan, then run the job again for the computers that failed.
  - `21`: your plan does not include **Unattended Access**.
- Computers that enrolled but stay **offline**: check for a proxy or HTTPS inspection, and see [Fix a Blink agent that will not connect](/troubleshooting/agent-wont-connect/).

## Remove the agent with your tool

To take the agent off computers, run this as the system account:

```bat
"C:\ProgramData\Blink\blink-agent.exe" --uninstall
```

It exits with `0` on success and `1` on failure. Then revoke or delete the devices in the console. See [Uninstall the Access agent](/install/uninstall-the-agent/).