Deploy the Access agent with your RMM tool

If you already manage your customers’ computers with a remote monitoring and management (RMM) tool, you can roll the Access agent out to all of them with one script. The script downloads the agent from your Blink address, checks its signature, installs it and enrolls the computer with your key. It runs silently, needs no one at the keyboard, and is safe to run again on a computer that already has the agent.

This page gives you the scripts, then the steps for each tool. For what the install command itself does, see Install the Access agent on Windows. Moving from another remote access tool? See Switch from your old remote access tool.

Before you start

• An enrollment key for each customer. A key enrolls computers into one organization and, optionally, one device group. Create one key per customer (or per site), with a Max uses that matches the rollout and an expiry you are comfortable with. See Create an enrollment key.
• Your Blink address, for example https://yourname.onblink.cloud.
• Free Access devices in your plan. Each enrolled computer takes one. See Access devices.
• Windows 10 or later, 64-bit (x64). See Check supported systems.
• A direct connection to your Blink address. The agent does not use a web proxy and refuses HTTPS inspection. Exclude your Blink address from both before the rollout. Otherwise the script’s download can succeed through the proxy while the installed agent cannot connect, and the computer stays offline. See Network.

The script runs as the system account or as an administrator, which is how these tools run scripts by default. It works in 32-bit and 64-bit PowerShell.

Where the agent comes from

Every Blink server hands out the generic Access agent at:

https://<your Blink address>/api/agent/binary

This is the same file as Access agent under Instance › License › Agent builds. It is signed by IZT Apps, Inc., carries your Blink address, and holds no enrollment key, so the URL needs no sign-in and is safe to put in a script. The key is passed on the command line instead, which keeps it out of the file and lets you keep it in your tool’s protected fields.

Self-signed certificate on premises

If your Blink server still uses its built-in certificate (browsers show a certificate warning), Windows refuses the download. Set up a trusted certificate, or upload blink-agent.exe to your tool and use the variant that skips the download.

Keep the key secret

Anyone with an enrollment key can enroll computers into that organization until the key is used up, expires or is revoked. Put the key in your tool’s secure or password-type field where it has one, not in the script text, and never in a script library shared outside your company. Many tools keep a copy of a script’s command line or text in their logs and job history, so assume the key can be read there too. Give each key a Max uses close to the number of computers and a short expiry, and revoke it when the rollout is done. See Keep keys under control.

Tell your security tools first

Installing a new remote access tool on many computers at once is exactly what attackers do, so security tools watch for it:

• Tell your SOC or MDR provider before a mass rollout, so they expect the new service and do not isolate computers.
• Application control (ThreatLocker, AppLocker, App Control for Business and similar): allow Blink by its publisher, IZT Apps, Inc., not by file hash or certificate thumbprint. The agent replaces itself with every update, and its signing certificate is renewed every few days, so hashes and thumbprints keep changing. The script runs the downloaded file from the system’s temp folder (C:\Windows\Temp when it runs as the system account). If your policy blocks programs there, allow it or use the file directly.
• Microsoft Defender: the attack surface reduction rule Block executable files from running unless they meet a prevalence, age, or trusted list criterion can block a newly released agent version for its first days. If you use that rule, add an exclusion for C:\ProgramData\Blink\blink-agent.exe and for the script’s download.

How tools can tell the agent is installed

The Access agent does not appear in Apps or Programs and Features, so a tool that checks for installed software by its display name never finds it and tries to install it again every time. Detect it by either of these instead:

• The Windows service BlinkAgent (registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent).
• The file C:\ProgramData\Blink\blink-agent.exe. Its product version is the agent version.

The PowerShell script

Use this with any tool that runs PowerShell. Tools hand values to scripts in different ways, so the script takes the Blink address and the enrollment key from the first of these it finds:

1. The variables $BlinkAddress and $EnrollKey, if your tool sets them or you add lines that set them (the steps for your tool say which lines). A placeholder your tool left unfilled, such as {{...}}, {[...]} or @...@, counts as not set.
2. Two command-line arguments: the address, then the key.
3. The environment variables BLINK_ADDRESS and BLINK_ENROLL_KEY.

# Install and enroll the IZT Blink Access agent.
# Exit codes: 0 installed, 1 failed, 2 address or key missing,
# 20 device limit reached, 21 plan does not include Access.

# >>> Lines for your tool go here (see the steps for your tool). <<<

# A placeholder your tool left unfilled counts as not set.
$placeholder = '^\s*(\{\{.*\}\}|\{\[.*\]\}|\x40.*\x40)\s*$'
if ("$BlinkAddress" -match $placeholder) { $BlinkAddress = $null }
if ("$EnrollKey" -match $placeholder)    { $EnrollKey    = $null }

if (-not $BlinkAddress -and $args.Count -ge 2 -and "$($args[0])" -notlike '-*') {
    $BlinkAddress = "$($args[0])"
    $EnrollKey    = "$($args[1])"
}
if (-not $BlinkAddress) { $BlinkAddress = $env:BLINK_ADDRESS }
if (-not $EnrollKey)    { $EnrollKey    = $env:BLINK_ENROLL_KEY }
$BlinkAddress = "$BlinkAddress".Trim().TrimEnd('/')
$EnrollKey    = "$EnrollKey".Trim()

$ErrorActionPreference = 'Stop'
$ProgressPreference    = 'SilentlyContinue'

if (-not $BlinkAddress -or -not $EnrollKey) {
    Write-Output 'Blink: set the Blink address and the enrollment key.'
    exit 2
}
if ($BlinkAddress -notmatch '^https?://') { $BlinkAddress = 'https://' + $BlinkAddress }

# Windows PowerShell 5.1 may not offer TLS 1.2 by default: add it.
# (No effect on PowerShell 7; not allowed in Constrained Language Mode.)
if ($ExecutionContext.SessionState.LanguageMode -eq 'FullLanguage') {
    $tls = [Net.ServicePointManager]::SecurityProtocol
    if ([int]$tls -ne 0) {
        [Net.ServicePointManager]::SecurityProtocol = $tls -bor [Net.SecurityProtocolType]::Tls12
    }
}

# Already installed and running: nothing to do.
$service = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
if ($service -and $service.Status -eq 'Running') {
    Write-Output 'Blink: the Access agent is already installed and running.'
    exit 0
}

# Download into a new folder of its own, which other users cannot find.
$temp = if ($env:TEMP) { $env:TEMP } else { Join-Path $env:SystemRoot 'Temp' }
$dir  = Join-Path $temp ('blink-' + [guid]::NewGuid().ToString('N'))
$exe  = Join-Path $dir 'blink-agent.exe'
$url  = $BlinkAddress + '/api/agent/binary'

try {
    $null = New-Item -ItemType Directory -Path $dir -Force
    Invoke-WebRequest -Uri $url -OutFile $exe -UseBasicParsing
} catch {
    Write-Output "Blink: could not download the agent from $url : $($_.Exception.Message)"
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}

# Run the file only if it is signed by IZT Apps, Inc.
$sig = Get-AuthenticodeSignature -FilePath $exe
if ($sig.Status -ne 'Valid' -or "$($sig.SignerCertificate.Subject)" -notmatch '(^|,\s*)CN="?IZT Apps, Inc\."?(,|$)') {
    Write-Output 'Blink: the downloaded file is not signed by IZT Apps, Inc., so it was not run.'
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
    exit 1
}

$code = 1
try {
    $p = Start-Process -FilePath $exe -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru -WindowStyle Hidden
    if ($null -eq $p.ExitCode) { throw 'its exit code could not be read.' }
    $code = $p.ExitCode
} catch {
    Write-Output "Blink: could not run the agent installer: $($_.Exception.Message)"
} finally {
    Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
}

switch ($code) {
    0       { Write-Output 'Blink: the Access agent is installed and enrolled.' }
    20      { Write-Output "Blink: this Blink plan's device limit is reached." }
    21      { Write-Output 'Blink: this Blink plan does not include Access.' }
    default {
        Write-Output "Blink: the install failed with exit code $code."
        $log = Join-Path $env:ProgramData 'Blink\install.log'
        Get-Content -LiteralPath $log -Tail 20 -ErrorAction SilentlyContinue
    }
}
exit $code

The script passes the agent’s own exit code back to your tool, so a failed install shows as failed. The codes are the ones in Exit codes; the script adds 2 when the address or key is missing. On a failure it prints the end of C:\ProgramData\Blink\install.log into the job output, so you can usually see the reason without connecting to the computer.

Before it runs the download, the script checks that the file carries a valid signature from IZT Apps, Inc. and stops with exit code 1 if it does not.

Running the saved file yourself

If you start the script file from a command line, use powershell.exe -File install-blink.ps1 <address> <key>. With -Command instead of -File, PowerShell turns every exit code other than 0 into 1, so your tool cannot tell 20 and 21 apart from other failures.

The Command Prompt script

Use this where your tool runs batch files, or for a Group Policy startup script. It needs curl.exe, which is part of Windows 10 and 11; keep Windows up to date so it is a current version. It retries the download for about two minutes, because at start-up the network may not be ready yet.

@echo off
rem Install and enroll the IZT Blink Access agent.
rem Exit codes: 0 installed, 1 failed, 2 address or key missing,
rem 20 device limit reached, 21 plan does not include Access.
setlocal
if not defined BLINK_ADDRESS set "BLINK_ADDRESS=https://yourname.onblink.cloud"
if not defined BLINK_ENROLL_KEY set "BLINK_ENROLL_KEY=PASTE-YOUR-KEY-HERE"

if "%BLINK_ENROLL_KEY%"=="PASTE-YOUR-KEY-HERE" (
    echo Blink: set the Blink address and the enrollment key.
    exit /b 2
)
if "%BLINK_ADDRESS:~-1%"=="/" set "BLINK_ADDRESS=%BLINK_ADDRESS:~0,-1%"

rem Already installed and running: nothing to do.
sc query BlinkAgent | find "RUNNING" >nul && (echo Blink: the Access agent is already installed and running.& exit /b 0)

rem Download into a new folder that only SYSTEM and administrators can write to.
set "CODE=1"
set "DIR=%TEMP%\blink-%RANDOM%%RANDOM%"
mkdir "%DIR%" || (echo Blink: could not create a download folder.& exit /b 1)
icacls "%DIR%" /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F >nul || goto :done
set "EXE=%DIR%\blink-agent.exe"
if exist "%EXE%" goto :done

rem Try for about two minutes: at start-up the network may not be ready yet.
set "TRIES=0"
:download
set /a TRIES+=1
"%SystemRoot%\System32\curl.exe" --fail --silent --show-error --location --ssl-revoke-best-effort --connect-timeout 30 --max-time 300 --output "%EXE%" "%BLINK_ADDRESS%/api/agent/binary"
if not errorlevel 1 goto :install
if %TRIES% geq 6 (
    echo Blink: could not download the agent from %BLINK_ADDRESS%.
    goto :done
)
ping -n 21 127.0.0.1 >nul
goto :download

:install
"%EXE%" --install --enroll "%BLINK_ENROLL_KEY%"
set "CODE=%ERRORLEVEL%"
if "%CODE%"=="0"  echo Blink: the Access agent is installed and enrolled.
if "%CODE%"=="20" echo Blink: this Blink plan's device limit is reached.
if "%CODE%"=="21" echo Blink: this Blink plan does not include Access.
if not "%CODE%"=="0" if not "%CODE%"=="20" if not "%CODE%"=="21" echo Blink: the install failed with exit code %CODE%. See C:\ProgramData\Blink\install.log.

:done
rd /s /q "%DIR%" >nul 2>&1
exit /b %CODE%

Replace the two set values, or have your tool set BLINK_ADDRESS and BLINK_ENROLL_KEY before the script runs. Unlike the PowerShell script, it does not check the file’s signature before running it.

If your tool ships the file

Some tools attach a file to a script or a software package and copy it to the computer before running it. That is also the way to go when computers cannot reach your Blink address over HTTPS during the rollout, or your server uses its built-in certificate.

1. Download Access agent from Instance › License › Agent builds, or select Agent on the card Blink shows right after you create an enrollment key. The file is blink-agent.exe. To check it, right-click it, select Properties › Digital Signatures, and make sure the signer is IZT Apps, Inc.

2. Add it to your tool’s package or script attachments.

3. Run it, from the folder the tool puts it in, with:

   blink-agent.exe --install --enroll <key>

A file you upload stays at the version you uploaded. That is fine for updates: the agent updates itself after it connects. Replace the uploaded file now and then, so new computers start on a recent version, and always download a fresh copy after your Blink address changes.

Steps for each tool

The menus below are the ones these tools show at the time of writing; they change from time to time, so check your tool’s own help if yours look different. The idea is always the same: add the PowerShell script, give it the address and key, run it as the system account on the computers you choose, and allow it a few minutes to finish.

Most tools let you store a value once per customer (a client, site or organization field). That is the best place for the enrollment key: one key per customer, and the same script for everyone.

Using Kaseya 365? Its endpoint management is Datto RMM or Kaseya VSA: follow the steps for the one you use.

NinjaOne

1. Create a custom field for the key. Go to Administration › Organizations › Organization Custom Fields, select + Add custom field › Field, and choose the Secure type. Give it a label such as Blink Enroll Key and note the Name NinjaOne fills in from it (for example blinkEnrollKey).

   • Make sure the field’s Inheritance includes devices. Scripts run on the device and cannot read the field otherwise.
   • On the Permissions tab, set Automations to Read Only. Scripts cannot read a field without it.

2. Fill in the field on each organization with that organization’s key. Leave it empty on locations and devices: a value there takes priority over the organization’s.

3. Go to Administration › Library › Automation › Add automation › New Script. Set Language to PowerShell, the operating system to Windows, Architecture to All and Run As to System.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add these lines, with the Name of your field:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = Ninja-Property-Get blinkEnrollKey

   Get-NinjaProperty -Name blinkEnrollKey -Type Secure is the newer equivalent and works too.

5. Run it on the devices: from a device’s action menu select Run Automation, or select several devices under Devices and click Run. To cover new devices too, go to Administration › Policies, open the policy, select Scheduled Automations › +Add automation, add the script and schedule it with Run once immediately. That runs it on online devices when you save the policy, on offline devices when they come back online, and on devices added to the policy later.

NinjaOne counts any exit code other than 0 as a failure. Check the result in the device’s Activities tab.

Test with Run Automation, not the terminal

NinjaOne hands secure fields only to a running automation. From the web terminal or a local terminal the key comes back empty, and the script stops with exit code 2.

Datto RMM

1. Go to Setup › Global Settings. Under Variables, click Add Variable for each of these, then click Save:
   • Name BLINK_ADDRESS, Value your Blink address.
   • Name BLINK_ENROLL_KEY, Value a placeholder that is not a key, for example none.
2. For each customer, go to Sites › All Sites and click the site. Click Settings in the left menu and scroll to Variables. Click Add Variable, enter Name BLINK_ENROLL_KEY and that customer’s key as the Value, tick Masked and click Save. Type the name exactly as above, including the capitals: a site variable only replaces the global one when the names match exactly. You cannot change Masked after saving.
3. Go to Automation › Components › Create Component. Choose the category Scripts and the script type PowerShell, and paste the PowerShell script unchanged. Datto RMM hands variables to PowerShell as environment variables, which the script reads. Set Timeout this script if not completed within (seconds) to at least 300.
4. Under Variables, in Global & Site, select the global BLINK_ADDRESS and BLINK_ENROLL_KEY. Datto RMM sends a component only the variables you select there, and each site’s own BLINK_ENROLL_KEY replaces the global placeholder when the job runs. If your editor has no Global & Site section yet, skip this step: the component then receives all global and site variables. Do not add either name under Component variables: a component variable always wins, even when it is empty. Click Create Component.
5. Run the component as a Quick Job on the customer’s devices (Devices › All, tick the devices, Quick Job). To catch new computers too, go to Automation › Jobs › Create Job, add the component, add the customer’s sites as targets, choose Initial Audit under Schedule, and keep Run as system account.

Quick jobs always run as the local system account. A job shows Success when the script exits with 0, and the script’s messages appear under StdOut/StdErr in the job results.

Caution

Never put a real key in the global BLINK_ENROLL_KEY. Every site without its own value receives the global one. With the placeholder, the job fails on those sites instead of enrolling their computers anywhere.

Masked hides the key in the console, but a computer with the agent’s extended logging turned on writes masked values to its log file in clear text. Make sure extended logging is off on the computers you target.

N-able N-central

1. Save the PowerShell script as install-blink.ps1. N-central does not accept spaces in script file names.

2. Go to Configuration › Scheduled Tasks › Script/Software Repository and select Add › Scripting. Enter a Name, select Browse next to File Name and choose install-blink.ps1. Leave Command Line Parameters empty here, because every task that uses this script shares that value. Select OK.

3. Go to Configuration › Scheduled Tasks › Add/Delete and select Add › Scripting. Enter a Task Name that includes the customer’s name, select Use LocalSystem Credentials, and choose the script you added to the repository. In Command Line Parameters, enter the address and that customer’s key, separated by a space:

   https://yourname.onblink.cloud <key>

4. On the Task Handler tab, have the agent run the script. On the Targets tab, pick that customer’s devices. On the Schedule tab, choose Now, Once or Recurring and set an Execution Timeout of at least 5 minutes. Select Save.

5. Repeat steps 3 and 4 for each customer, so each task uses its own key.

N-central does not check the script or its parameters before it runs the task, so try the task on one device first. If you target devices with a filter, N-central uses a snapshot of that filter, so devices added later are not included. To cover them, N-able recommends a scheduled task profile.

Caution

Command Line Parameters is not a masked field. Anyone who can open the task can read the key, so use short-lived keys with a low Max uses and revoke them when the rollout is done.

Keep the key in a password property

N-central can hold a masked value per customer in a custom property (Administration › Custom Properties › Add › By Customers › Password Type). Only Automation Manager policies can use it. Build a policy with a Run PowerShell 5.1 Script object, paste the PowerShell script, and add input parameters named BlinkAddress and EnrollKey. The script receives them as $BlinkAddress and $EnrollKey, so it needs no extra lines. When you add the task with Configuration › Scheduled Tasks › Add/Delete › Add › Automation Policy, set the EnrollKey input parameter to the custom property. N-able notes that this object handles password inputs as ordinary text once the script runs.

If a task fails, the N-central agent writes the error code, for example AG_ERR_REMO_043 with the return code, to RemoteExecutionModule.log or agent.log in its log folder on that computer. The script also prints the end of C:\ProgramData\Blink\install.log to the task output.

N-able N-sight RMM

1. Save the PowerShell script, unchanged, as install-blink.ps1.

2. In the All Devices view, go to Settings › Script Manager and select New. In Add User Defined Scripts, enter a Name, set Type to Automated Task, choose Windows as the OS, and set Default Timeout (in seconds, at most 3600) high enough for the download and install, for example 600. Browse to install-blink.ps1 and select Save.

3. In the client list, right-click the customer’s client or site and select Task › Add. Select the script and select Next. When asked, choose servers, workstations or both.

4. Enter a task name. In Command Line, enter the address and the key, separated by a space:

   https://yourname.onblink.cloud <key>

5. In Select Frequency Method, choose Manual to run it now, or a schedule. Select Next, select the devices that should get the agent, and select Add Task.

Use a separate task for each customer, so each one uses its own key. The task runs with the account of the Advanced Monitoring Agent service, which is the local system account unless someone changed it. On computers that already have the agent, the script ends straight away, so running the task again is safe.

N-sight adds two arguments of its own (-logfile and a file name) after yours. The script reads only the first two, so leave it as it is and do not add a param() block.

The key is stored in plain text

N-sight has no protected field for task parameters, so the key is stored in plain text on the task. Give the key a short expiry and revoke it when the rollout is done.

N-sight marks any exit code other than 0 as failed. It reserves codes 1 to 999 for its own scripts, so for the script’s codes 1, 2, 20 and 21 the task shows as failed but the script’s message may not show correctly. N-sight may also shorten the output, and results appear only after the device next checks in. Look at the exit code and Check the rollout.

ConnectWise RMM

1. Create a custom field for the key. Go to Settings › Custom Fields › Add Field +. Name it Blink_Enroll_Key (letters, numbers and underscores only), set Level to Company (or Site if you use one key per site) and Type to Text Box, leave the default value empty, and mark the field as editable. Then, for each customer, go to Clients › Companies, select the company, open its Custom Fields tab and enter that customer’s key.

2. Go to Automation › Tasks › Add › Script Editor and name the task. Every row you add needs an Operating System: choose Windows.

3. Click Add Row and choose Set Pre-defined Variable. Enter Enroll_Key as the variable name, choose Custom Field and select Blink_Enroll_Key.

4. Click Add Row and choose PowerShell Script. Set Run As to System, set Expected time of script execution in seconds to 600, and tick Continue on Failure so the rows after it still run. Paste the PowerShell script, and in place of the “Lines for your tool” comment add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@Enroll_Key@'

   ConnectWise RMM replaces @Enroll_Key@ with the key from the computer’s company before the script runs.

5. Click Add Row, choose Script Log and enter %output% as the message, so the script’s output shows in the task results.

6. Click Add Logic. Build the condition on Output, Does not contain, Blink: the Access agent is, and under it add a Script Exit row with the message Blink: the install failed. See the output above. Both of the script’s success messages contain that text and none of its failure messages do, so a refused install shows as a failed task.

7. Click Save. Select the task and click Schedule. Choose Run Now, a schedule, or Next Agent Check-In for computers that are offline (a Run Now task on an offline computer fails by timeout). Click Select Targets, choose the companies, sites, device groups or devices, and click Run.

Caution

ConnectWise RMM has no masked field type. Anyone whose role can view custom field values can read the key. By default that includes Manager, Technician, Office Staff and Client Site Manager. Revoke the key when the rollout is done.

Note

To type the key when you schedule the task instead, skip steps 1 and 3. Click Add Parameter in the Script Editor, name it Enroll_Key with the type Text String, and enter the key under Schedule, with a separate schedule for each customer. Parameter values show on the task’s Scheduling tab.

ConnectWise Automate

1. Create a client-level extra data field (EDF) for the key, with Field Type Text, for example named Blink Enroll Key, and fill in each client’s key.

2. Under Automation, pick a script folder and add a new script with Target set to Computer.

3. Add an ExtraData Get Value step. As Extra Field, pick your key field (the entry for the client level). Enter %clientid% as ID and BlinkEnrollKey as Variable, without @ signs.

4. Add an Execute Script step from Command Execution. Set Script Type to PowerShell Bypass, so the computer’s execution policy does not block it. Set Script Credentials to Local Agent, so it runs as the system account. Enter BlinkResult as Variable.

5. Paste the PowerShell script into the script box. In place of the “Lines for your tool” comment, add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '@BlinkEnrollKey@'

   Automate replaces @BlinkEnrollKey@ with the client’s key before the script runs.

6. Add a Script Log Message step with @BlinkResult@, so the script’s Blink: lines show in the script log.

7. Save the script. Run it on one computer and check the script log, then run it on the client’s computers or groups.

Caution

Automate replaces @name@ and %name% tokens anywhere in the script text. The Blink PowerShell script has none of its own, so do not add any when you edit it. Use the PowerShell script here, not the Command Prompt one.

Tip

If the install fails, check that the client’s field is filled in, that the Extra Field and ID in step 3 match a client-level field, and that the variable name is spelled the same in steps 3 and 5. If you mark the key field as masked, test on one computer first to make sure the key still reaches the script.

To ship the file instead, put blink-agent.exe in the LTShare\Transfer folder on your Automate server. Add a File Download step that saves it to the computer, for example as C:\Windows\Temp\blink-agent.exe. Then add a Process Execute step with that path as File, --install --enroll @BlinkEnrollKey@ as Arguments, and Wait for Process.

Kaseya VSA 10

Kaseya VSA 10 was formerly called VSA X. You keep each customer’s key in an organization custom field and run the PowerShell script from the Automation Hub.

1. Create the custom field. Go to Automation › Custom Fields and click Create Custom Field. Enter a Display Name such as BlinkEnrollKey, set Type to Text, select only Organization under Contexts, leave Expires off, and click Create.
2. Fill in each customer’s key. Go to Configuration › Organizations and select the organization. On the Custom Fields tab, click Edit, then Assign Custom Field. Pick the field, choose Enter manually, paste that customer’s key, click Add, then Save.
3. Go to Automation › Automation Hub, select a folder under User Defined, open the Scripts tab and click Create Script. Give it a Name.
4. Under Inputs, click + New and add two variables, clicking Save Variable after each. The names must match exactly, because the script reads them by name:
   • Name BlinkAddress, Variable Type Text, Default Value your Blink address.
   • Name EnrollKey, with Use custom field value turned on and the field from step 1 selected as the Custom Field.
5. In the Windows section, turn on Enable and keep the Script type as PowerShell. Paste the PowerShell script into the editor below the input lines VSA 10 adds at the top, then click Create (Save when you edit an existing script). VSA 10 hands each input to the script as a PowerShell variable with the same name, so $BlinkAddress and $EnrollKey are already set and you need no lines in place of the “Lines for your tool” comment.
6. Go to Devices › Device Management, select the customer’s computers, and choose Actions › Run Script. Pick the script, click Next, choose Run now and click Run. If VSA 10 asks you to confirm, tick the box and click Confirm. Scripts started this way run as System. Follow progress with Bulk Action History at the top of the page. To run the script on a schedule, add it to a task on the Tasks tab of the Automation Hub.

If the job output shows Blink: set the Blink address and the enrollment key., an input did not arrive. Check that the input names are exactly BlinkAddress and EnrollKey, and that the organization has a value for the custom field.

The key is not hidden

VSA 10 custom fields have no secure or password type, so the key is stored as plain text and other VSA 10 users can see it. Revoke the key when the rollout is done.

Shipping the file instead

To push blink-agent.exe from VSA 10 rather than download it, upload it on the Managed Files tab of a User Defined folder in the Automation Hub with Upload File. Then build a workflow with a Write File action, which copies the file to C:\ProgramData\Kaseya\VSAX\Working. Add an Execute PowerShell Command action that runs & "C:\ProgramData\Kaseya\VSAX\Working\blink-agent.exe" --install --enroll <key> as System, not as the current user. Finish with a Delete File action. The key in that command is plain text too. Each workflow action stops after 30 minutes.

Tip

Don’t run the script from a Client Portal troubleshooter. Troubleshooters run scripts as the logged-in user, not as System.

Kaseya VSA 9

These steps are for the classic VSA (9.x) Agent Procedures. Run the PowerShell script as a file. Do not paste it into a step: VSA reads <, > and # in a step’s fields as variable markers, and the script contains all three.

1. Save the PowerShell script unchanged as install-blink.ps1. You do not need to add any lines, because the procedure passes the address and key as arguments. Go to Agent Procedures › Manage Procedures › Schedule / Create, click Manage Files, choose Shared files and upload it. If VSA refuses the file, add the .ps1 extension under Server Management › Default Settings.
2. Click Manage Variables. Select <New Variable>, name it BlinkEnrollKey (names are case sensitive) and choose Public if other VSA users will run the procedure. Only master role users can create public variables. Enter one customer’s key in Set Variable Value, tick that customer’s group IDs and click Apply. Repeat for each customer.
3. Select a folder, click New Procedure and add these steps in order:
   • getVariable(): choose Secure Agent Working Directory Path and store it in a variable named blinkdir.
   • writeFile(): write the uploaded install-blink.ps1 to #blinkdir#\install-blink.ps1.
   • executePowerShell64BitSystem: use #blinkdir#\install-blink.ps1 as the file, https://yourname.onblink.cloud <BlinkEnrollKey> as the arguments, and turn on the option that sends the output to a variable.
   • writeProcedureLogEntry(): enter #global:psresult#, so the script’s Blink: lines appear in the machine’s Agent Procedure Log.
4. Select the procedure. On the Schedule tab, tick the machines and click Run Now or Schedule Procedure. Run it only on machines whose group has a BlinkEnrollKey value.

The key is not hidden

VSA 9 has no secret variable type. Users who open Manage Variables see the key in plain text for the groups they administer. Revoke the key when the rollout is done.

Note

VSA’s help does not say whether the script’s exit code marks the step as failed, so check the Blink: line in the log, not only the procedure status. When VSA runs PowerShell as System, it sets the computer’s LocalMachine execution policy to Unrestricted. To change it back, add a final step that runs Set-ExecutionPolicy with your usual value.

To ship the file instead, upload blink-agent.exe with Manage Files and use writeFile() to copy it to #blinkdir#\blink-agent.exe. Then use executeFile() on that path with the arguments --install --enroll <BlinkEnrollKey>, run it as the system account, and have the procedure wait until it completes.

Atera

1. Go to Admin › Monitoring and automation › Scripts and click + Create script. Enter a Script Name and Script description, and set File type to .ps1.

2. Click More script properties. Leave Run as on System and Arguments empty, and don’t set Max script run time (minutes) below 5.

3. Paste the PowerShell script into the script editor. In place of the “Lines for your tool” comment, add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{[EnrollKey]}'

   {[EnrollKey]} is an Atera script variable: Atera puts the value you give it into the script text before it runs. Click Create.

4. Go to Customers, open the customer and go to the Devices tab. Select the devices and click Run script. Choose how long to queue the script for devices that are offline, pick the script, and paste that customer’s key when Atera asks for the EnrollKey value.

To run it on a schedule instead, add the script to an automation profile under Admin › Monitoring and automation › Patch management and IT automation, set the EnrollKey value in the profile, and assign the profile to the customer. The value is saved in the profile, so use a separate profile for each customer.

To check a manual run, go to Reports › General › Recent Processes, expand the customer and click the info icon to see the script output with the Blink messages. Results from automation profiles are not in that report; see Reports › Classic Reports › Patch & Automation Feedback.

Caution

Atera has no secret or masked script variable, so the key is stored and shown as plain text. Revoke it when the rollout is done.

You can also upload blink-agent.exe with Upload script on the same page and put --install --enroll <key> in Arguments (see If your tool ships the file). The key is then part of the script’s settings, so you need one upload per customer. On the Pro plan, uploaded .exe files can be at most 20 MB.

Syncro

1. Create a custom field for the key. Go to Admin, and under Customers select Customer Custom Fields › New Field. Name it Blink Enroll Key, set Field Type to Text Field and click Create Field. Then fill in each customer’s key on that customer’s record. (Syncro is renaming Customers to Organizations, so some screens may say Organization instead.)

2. Go to Scripts › +New Script. Set File Type to PowerShell, Run As to System, and Max Script Run Time (minutes) to at least 5.

3. Click Add Script Variable and add a variable named EnrollKey of type Platform. For its value, choose {{customer_custom_field_blink_enroll_key}}. Syncro builds this name from the field name in lower case, with spaces turned into underscores, so it must match the field you created. When the script runs, $EnrollKey holds the key of the asset’s customer.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add only the address:

   $BlinkAddress = 'https://yourname.onblink.cloud'

   Do not set $EnrollKey in the script. It comes from the variable. Do not use a Runtime variable for the address either: Syncro asks for runtime values every time someone schedules the script.

5. Click Create Script. To run it, open an asset’s Scripts tab, click +Add to Queue and choose System under Run As. For several assets at once, tick them and choose Run Script… from Bulk Actions. To cover new computers too, add it to a policy’s Scripting category as a Setup Script or under Script Schedules.

Each run’s result and output are in the asset’s Scripts tab under Script History. The script returns the agent’s exit code, and Syncro uses a non-zero code to flag the run as failed. On a failure the output includes the end of install.log.

Caution

Syncro custom fields have no masked type, so anyone who can open the customer in Syncro can read the key. Give each key a Max uses close to the number of computers and a short expiry, and revoke it when the rollout is done.

Tip

If the computers cannot download from your Blink address, use the file directly. In Scripts, click Add New File and upload blink-agent.exe. Then edit the script, click +Add Required File, choose the file, and in Destination File Name enter a full path that ends in the file name, for example C:\Windows\Temp\blink-agent.exe. Keep the EnrollKey variable and use this script instead:

$p = Start-Process -FilePath 'C:\Windows\Temp\blink-agent.exe' -ArgumentList '--install', '--enroll', $EnrollKey -Wait -PassThru
exit $p.ExitCode

SuperOps

1. Create a client custom field for the key, for example Blink Enroll Key: go to Settings › Advanced Configuration › Manage Fields, open the client fields and select + Create. Fill in each customer’s key under Additional properties on that client’s profile.

2. Go to Modules › Scripts and select +Script. Set the language to PowerShell, set Run as to the system (root) user rather than the logged-in user, and set Script timeout to at least 5 minutes.

3. Select + Add placeholder variables, enter BlinkCustomerKey as the name, and pick your Blink Enroll Key client field from the dropdown.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = "$BlinkCustomerKey"

5. Save the script. Run it from Modules › Assets (tick the customer’s computers and select Run script), or add it to a policy so new computers get the agent too.

Variable names in SuperOps

SuperOps fills in $BlinkCustomerKey wherever that name appears in the script. Keep the double quotes, because SuperOps does not fill in a name inside single quotes. Do not name a SuperOps variable BlinkAddress, EnrollKey or any part of those names, because SuperOps would also replace the script’s own variables and break it.

If you would rather type the key when you run the script, select + Add run time variables with the same name instead of a placeholder variable. SuperOps asks for the value each time you run the script, or once when you add it to a policy.

SuperOps has no secure script variable, so treat the client field as readable by your team and revoke the key when the rollout is done.

Action1

Action1 runs scripts as the Local System account. You add the script to your Script Library once, then run it in each customer’s organization with that customer’s key.

1. Go to Configuration › Script Library and select New Script. Enter a name, then on the Script step set the language to PowerShell and paste the PowerShell script.

2. Replace the line # >>> Lines for your tool go here (see the steps for your tool). <<< with these two lines. Action1 hands parameters to PowerShell scripts as variables named after the parameter:

   $BlinkAddress = "$BLINK_ADDRESS"
   $EnrollKey    = "$BLINK_ENROLL_KEY"

3. In the Parameters section, select Add parameter and add BLINK_ADDRESS and BLINK_ENROLL_KEY, both of type String. Give BLINK_ADDRESS your Blink address as its default value. Do not put a real key in the default value of BLINK_ENROLL_KEY: Script Library scripts are available to every Action1 user in your enterprise who can use scripts.

4. Leave the script’s exit codes empty. Action1 uses the codes you enter there to decide when to restart the computer, not to decide whether the script worked.

5. On the Test step you can run the script on one computer with a key typed in. This really installs the agent and enrolls that computer, so only test on a computer of the customer whose key you use. Then finish the wizard.

6. For each customer, switch to that customer’s organization at the top of the Endpoints page, select the computers and select Run Script. Pick the script from the Script Library, enter that customer’s key as BLINK_ENROLL_KEY, and in the reboot options choose Do not reboot automatically. To reach computers that are offline right now, schedule the run instead of running it now, and set an Automation completion deadline under Missed schedule retry and maintenance window.

7. Check the result under Automations › History. The job output shows the script’s messages, and on a failure the end of the agent’s install log.

If you prefer the Command Prompt script, set the language to CMD and add the same two String parameters. Action1 passes CMD parameters as environment variables, which the script reads, so you can paste it as is: its two set lines only fill in values that are missing.

Caution

Action1 has no hidden or password parameter type, so the key is stored and shown as plain text. Give each customer’s key a Max uses that fits the rollout and a short expiry, and revoke it when you are done.

Note

If your Action1 enterprise uses Endpoint Takeover Prevention, an Enterprise Admin must sign the script and the automations that run it with their Action1 Key, or computers block them. If your enterprise requires signed PowerShell scripts, sign the script after adding the two lines and upload the file instead of pasting it.

Tip

Use the script rather than a Software Repository package. Action1 recognizes a package by its display name in the computer’s installed apps, and the Access agent does not add itself there, so Action1 cannot tell whether it is installed.

Level

1. Go to Workspace › Custom Fields and select + Add custom field. Name it, for example, blink_enroll_key, leave Field value empty, turn on Admin only, and select Add custom field. Admin only hides the value in the web interface from everyone except account administrators. Scripts can still use it.

2. Set the key for each customer on their group. Go to Devices, select the customer’s group, open Custom fields, select ⋮ › Edit on the field, enter the key in Field value and select Update custom field. Level uses the most specific value it finds: device, then group, then the global value. Do not put a key in the global value, or every customer would enroll into the same Blink organization.

3. Go to Scripts and select + Create script. Set the language to PowerShell, Run as to Local system, and Timeout (in seconds) to at least 600. The default is 100 seconds, and a script that runs longer is marked as failed.

4. Paste the PowerShell script. In place of the “Lines for your tool” comment, add the lines below. Insert the field with the {x} button in the editor so its name matches exactly. If a group has no key, Level leaves the placeholder in place, which the script treats as missing: it stops with exit code 2. Then select Save script.

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = '{{cf_blink_enroll_key}}'

5. Go to Automations, select + Create automation, add the Run script action (under System) and pick your script. Add a trigger, or use Add a device to run it on the computers you choose. To try it on a few computers first, select them in the device list and choose Actions › Run saved script. Level asks you to approve that run before it starts.

Level marks the step as failed when the script exits with any code other than 0. To read the script’s output, open the run on the automation’s History tab and expand the step. Computers that are offline run the automation when they next come online.

Tactical RMM

Tactical RMM runs scripts as SYSTEM with Windows PowerShell. It has no masked field type, so keep the key in a client custom field and pass it as an environment variable. Tactical RMM does not log environment variables, while Script Arguments end up in the computer’s PowerShell event log.

1. Go to Settings › Global Settings › Custom Fields and select Add custom field. Set Target to Client, Name to BlinkEnrollKey and Field Type to Text, then select Submit. Leave Hide in Dashboard clear: it hides the field from the client form where you enter the key.

2. For each client, right-click it in the client tree, select Edit, enter its key under Custom Fields and select Save. Anyone who can edit the client can see the key.

3. Go to Settings › Script Manager › New › New Script. Set Shell Type to Powershell and paste the PowerShell script. Change its last line from exit $code to:

   $host.SetShouldExit($code); exit $code

   Tactical RMM reports a plain exit with any code other than 0 as 1. This line passes the agent’s real exit code through, for example 20 or 21. The script’s earlier exits, including exit 2, still show as 1, which still counts as a failure.

4. In Environment vars, type each of these lines and press Enter after each one:

   BLINK_ADDRESS=https://yourname.onblink.cloud
   BLINK_ENROLL_KEY={{client.BlinkEnrollKey}}

   The name between {{ }} is case sensitive and must match the custom field exactly. If a client’s field is empty, Tactical RMM leaves the variable out. The script then prints “Blink: set the Blink address and the enrollment key.” and Tactical RMM shows exit code 1.

5. Set Timeout (seconds) to 600. With the default of 90 seconds, the job can be stopped during the download or install, and Tactical RMM then reports exit code 98.

6. Leave Run As User (Windows only) clear, so the script runs as SYSTEM, and select Save.

7. Run it: right-click an agent and select Run Script, or use Tools › Bulk Script for a client or site. Leave Run As User clear there too. To reach new computers as they are added, go to Settings › Automation Manager and add the script to a policy as a task with Task run type set to Onboarding.

Note

The run forms and new tasks copy the script’s environment vars and timeout when you pick the script. A task you added earlier keeps its old values. Run Script with Wait for Output shows the script output and the Return Code. Runs from Bulk Script and tasks are listed on the agent’s History tab.

Pulseway

Pulseway has no secret or password-type field: custom fields and script variables are plain Text, Number, Date or Boolean. Keep the key in a custom field rather than in the script text, and revoke it when the rollout is done.

1. Go to Automation › Custom Fields and create a Text custom field for the key, for example BlinkEnrollKey, with the Organization context. Set its value on each customer organization. A value set on a computer itself takes priority over the organization’s, so leave it empty at that level.

2. Go to Automation › Automation Hub, open User Defined (or a folder in it) and select Create Script.

3. Enable the script for Windows, choose PowerShell and paste the PowerShell script.

4. Add an input variable named EnrollKey (no $), of type Text, and bind it to your key field. Pulseway adds a line such as $EnrollKey = '...'; at the top of the script for you.

5. In place of the “Lines for your tool” comment, add only the address:

   $BlinkAddress = 'https://yourname.onblink.cloud'

6. Save the script. To test it on one computer, select the computer in Device Management and use Action › Run Script. For the rollout, create a task on the Automation Hub page with a scope that covers the customer’s computers.

Pulseway marks a script as failed when it exits with a code other than 0, so a refused install shows as failed, with the script output. A computer whose organization has no key value exits with code 2.

PowerShell User Impersonation

Pulseway runs scripts as the system account by default. If PowerShell User Impersonation is turned on for a computer (Pulseway Manager › Settings › Runtime), PowerShell scripts run as the configured user instead. That user must be a local administrator for the install to work.

LogMeIn Resolve

LogMeIn Resolve was called GoTo Resolve until 2025.

1. Go to Devices › Remote Execution and select Create new job.
2. Under Scripting, add a PowerShell execution step and paste the PowerShell script. In place of the “Lines for your tool” comment, set $BlinkAddress and $EnrollKey.
3. Choose the customer’s devices. Turn on Retry job for offline devices to catch computers that are switched off, then select Run.

Scripts run as the system account, and each step may take up to two hours. The key is part of the script text, so give it a Max uses close to the number of computers and a short expiry. If a device shows Job failed, select View logs: the script prints the reason on a line starting with Blink:.

ManageEngine Endpoint Central

The menus are the same in Endpoint Central MSP. Use one configuration per customer, each with that customer’s enrollment key.

1. Save the PowerShell script as install-blink.ps1. Go to Configurations › Script Repository › Add Script and upload it. Type the file name yourself rather than pasting it.

2. Go to Configurations › Add Configurations › Windows Configuration › Custom Script › Computer Configuration.

3. Choose Repository and pick install-blink.ps1 in Script Name.

4. In Script Arguments, enter the address and the key, separated by a space and without quotes:

   https://yourname.onblink.cloud <key>

   Select Mask Sensitive Data so the key is hidden from end users during deployment.

5. Leave Exit codes at 0, so any other code shows as failed.

6. Set Frequency to Once and select Enable logging for troubleshooting. The script’s output, including the end of the install log on a failure, then shows in Remarks.

7. Set Run As to System user.

8. Define the targets and click Deploy Immediately.

Check the result per computer under Execution Status and Remarks. By default, Endpoint Central gives a script 60 minutes and then reports The wait operation timed out - Error Code: 258.

Caution

Mask Sensitive Data hides the key from end users, but console users with the right scope and role can still see it through View Script. Never type the key into the script itself.

You can also deploy the file as a software package (see If your tool ships the file). Go to Software Deployment › Package Creation › Packages › Add Package › Windows, choose the package type EXE/APPX/MSIEXEC/MSU/MSIX/MSIX Bundle, select From Local Computer and upload blink-agent.exe. In Installation Command with Switches/Arguments, enter:

blink-agent.exe --install --enroll <key>

Under Advanced Settings, make sure Exit Code lists 0. Deploy it from Software Deployment › Deployment › Install/Uninstall Software › Windows › Computer Configuration, with Install As set to System User, and click Deploy Immediately. Deploy waits for the next 90-minute refresh cycle or startup. The key is part of the package command, so create one package per customer.

Automox

Use a Worklet, not a Required Software policy: the agent does not appear in the list of installed programs, which is what a Required Software policy checks.

1. Go to Settings › Secrets & Keys, select Add Secret, and save the customer’s key as a secret, for example named Blink enroll key.

2. Go to Automate › Policies › Create Policy, and in the Worklets section choose Windows. Enter a Policy Name.

3. Under Inputs, select Add Input. Set Variable Name to BLINK_ENROLL_KEY and choose your secret in Select Organization Secret.

4. In Scope, put this in the evaluation code. It tells Automox to install only where the agent is not running:

   $s = Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue
   if ($s -and $s.Status -eq 'Running') { exit 0 } else { exit 1 }

5. Paste the PowerShell script into the remediation code. In place of the “Lines for your tool” comment, add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = $BLINK_ENROLL_KEY

6. Set a Schedule, use Associate Groups to pick the customer’s groups, and select Create Policy.

Worklets run as the system account in 32-bit PowerShell, which the script handles. When you run the policy by hand, Automox skips the evaluation code and runs the remediation code directly, which is safe: the script does nothing on computers that already run the agent.

JumpCloud

1. Go to Settings › Automation Variables and select +Variable. Name it, for example, blink_enroll_key, choose the String data type, paste the customer’s key as the Value, and turn on Secret Variable. Create it in each customer’s organization.

2. Go to Device Management › Commands, select + Command › Command, set Type to Windows and set the command to run as PowerShell.

3. Paste the PowerShell script into Command. In place of the “Lines for your tool” comment, add:

   $BlinkAddress = 'https://yourname.onblink.cloud'
   $EnrollKey    = {{blink_enroll_key}}

   Do not put quotes around {{blink_enroll_key}}: JumpCloud adds them when the command runs.

4. Set Timeout After to at least 300 seconds.

5. On the Device Groups or Devices tab, choose the customer’s computers, select Save, then Run Now.

Commands run as the system account in a 32-bit process, which the script handles.

ImmyBot

ImmyBot uploads the file itself and hands each customer’s key to the install script from a tenant license.

1. Go to Library › Software › New. Set Installer Type to File, choose Full Installer Package, and upload blink-agent.exe (see If your tool ships the file).

2. Name the software, for example IZT Blink Access agent, and enter the uploaded file’s version as the Version String.

3. For the detection method, choose a custom detection script that runs as System:

   $exe = Join-Path $env:ProgramData 'Blink\blink-agent.exe'
   if ((Get-Service -Name 'BlinkAgent' -ErrorAction SilentlyContinue) -and (Test-Path $exe)) {
       (Get-Item $exe).VersionInfo.ProductVersion
   }

   The agent does not appear in the list of installed programs, so detection by display name does not find it.

4. Under Installation, select New, set the execution context to System, and use:

   $p = Start-Process -FilePath $InstallerFile -ArgumentList '--install', '--enroll', $LicenseValue -Wait -PassThru -NoNewWindow
   if ($p.ExitCode -ne 0) { throw "Blink: the install failed with exit code $($p.ExitCode)." }

5. Make the software require a license, and add a license key for each tenant that holds that customer’s enrollment key. ImmyBot passes it to the install script as $LicenseValue.

6. Go to Deployments › New, choose Software and this software, set the enforcement to Required, and target Single Tenant with that customer’s computers. The deployment applies the next time a maintenance session runs.

The agent updates itself, so the installed version soon becomes newer than the one you uploaded.

Microsoft Intune

Intune runs the PowerShell script as a Win32 app. Win32 apps have no script variables or per-customer fields, so the address and key go into the install command. Create one app for each customer tenant, or for each enrollment key. Win32 apps need Windows Pro, Enterprise or Education.

1. Save the PowerShell script as install-blink.ps1 in an empty folder, for example C:\BlinkPackage. Wrap it into an .intunewin file with the Microsoft Win32 Content Prep Tool:

   IntuneWinAppUtil.exe -c C:\BlinkPackage -s C:\BlinkPackage\install-blink.ps1 -o C:\BlinkOutput

   Keep IntuneWinAppUtil.exe itself out of that folder, because everything in the folder goes into the package.

2. In the Microsoft Intune admin center, go to Apps › All Apps › Create. Choose the Windows platform, then Windows app (Win32), and click Select. Click Select app package file and upload the .intunewin file.

3. On Program, set:

   • Installer type: Command line.

   • Install command:

     %SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -File install-blink.ps1 https://yourname.onblink.cloud <key>

     Keep the Sysnative path. A plain powershell.exe in this field starts 32-bit PowerShell.

   • Uninstall command: "C:\ProgramData\Blink\blink-agent.exe" --uninstall. Intune does not expand environment variables in this field, so keep the full path.

   • Install behavior: System.

   • Leave the return codes as they are. 0 is Success. Any exit code that is not on the list, such as 1, 2, 20 or 21, shows as a failed install.

4. On Requirements, set Operating system architecture to x64 and Minimum operating system to the oldest Windows 10 or 11 release you support.

5. On Detection rules, choose Manually configure detection rules and add a Registry rule:

   • Key path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BlinkAgent
   • Value name: leave empty.
   • Detection method: Key exists.
   • Associated with a 32-bit app on 64-bit clients: No.

6. On Assignments, under Required, select Add group and choose a group with the customer’s devices. Then click Create on Review + create.

Caution

Anyone who can view the app in Intune can see the key in the install command, and the Intune Management Extension logs in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs on each computer can contain it too. Give the key a Max uses close to the number of computers and a short expiry, and revoke it when the rollout is done.

If an install shows as failed, open C:\ProgramData\Blink\install.log on the computer to see why. AppWorkload.log in the folder above shows the exit code Intune received.

Microsoft Configuration Manager

Configuration Manager installs the agent as an application. You do not need the script: use the file directly (see If your tool ships the file).

1. Put blink-agent.exe in a folder of its own on a network share that the site server’s computer account can read.

2. In the Configuration Manager console, go to Software Library › Application Management › Applications and select Create Application. Choose Manually specify the application information and give it a name.

3. On the Deployment Types page, select Add, set Type to Script Installer and choose Manually specify the deployment type information.

4. On the Content page, set:

   • Content location: the folder from step 1.
   • Installation program: blink-agent.exe --install --enroll <key>
   • Uninstall program: "C:\ProgramData\Blink\blink-agent.exe" --uninstall

   Leave Run installation and uninstall program as 32-bit process on 64-bit clients cleared.

5. On the Detection Method page, select Add Clause and add a Registry rule: Hive HKEY_LOCAL_MACHINE, Key SYSTEM\CurrentControlSet\Services\BlinkAgent, with no value, so the key only has to exist.

6. On the User Experience page, set Installation behavior to Install for system, Logon requirement to Whether or not a user is logged on, and Installation program visibility to Hidden.

7. Finish the wizard, distribute the content to your distribution points, and deploy the application to a device collection with the purpose Required.

The default return codes of a Script Installer count only 0 as success (plus the restart and retry codes), so 1, 20 and 21 show as failed. The key is part of the installation program, which every console user who can read the application can see, so give it a Max uses close to the number of computers and revoke it when the rollout is done.

Group Policy

Use the Command Prompt script as a computer startup script. Group Policy has no secure field, so the key goes in the script file itself.

1. Save the Command Prompt script as install-blink.cmd, with your Blink address and the enrollment key filled in on the two set lines.
2. In Group Policy Management, right-click the organizational unit that holds the computers (not the users) and select Create a GPO in this domain, and Link it here. Name it, then right-click the new Group Policy Object and select Edit.
3. Go to Computer Configuration › Policies › Windows Settings › Scripts (Startup/Shutdown) and double-click Startup.
4. Select Show Files and copy install-blink.cmd into the folder that opens. The file is then stored with the Group Policy Object, where the computers can read it at start-up.
5. Back in Startup Properties, select Add, then Browse. Pick install-blink.cmd from that same folder, then select OK in both dialogs.

Startup scripts run as the local system account when the computer starts, so each computer needs a restart. By default Windows applies Group Policy in the background while it starts, so a computer may need more than one restart before it runs the script. To make computers wait for the network and apply the policy on the first restart, enable Always wait for the network at computer startup and logon under Computer Configuration › Policies › Administrative Templates › System › Logon. A computer that is off the company network when it starts does not run the script. It runs it at a later restart on the network.

On computers that already run the agent, the script ends straight away, so it does no harm on later restarts.

By default Windows gives all Group Policy scripts together 10 minutes, then stops them. If you already run other long startup scripts, enable Specify maximum wait time for Group Policy scripts under Computer Configuration › Policies › Administrative Templates › System › Scripts and raise the time.

Group Policy does not show you whether the install worked. Use Check the rollout to see which computers enrolled.

Caution

The script, with the key, is stored in SYSVOL. By default every user in the domain can read it, and so can anyone with administrator rights on a domain computer. Give the key a Max uses close to the number of computers and a short expiry. When the rollout is done, remove the script in Startup Properties, delete the file in Show Files (Remove only takes it off the list) and revoke the key.

PDQ Deploy and PDQ Connect

You do not need the script. Both tools copy an EXE to the computer and run it with your parameters. First download blink-agent.exe (see If your tool ships the file).

PDQ Deploy

1. Select New Package on the toolbar (or File › New Package) and give the package a name that includes the customer. A new package has no steps yet.
2. Select New Step › Install. Set Install File to blink-agent.exe and Parameters to --install --enroll <key>.
3. Leave Success Codes as they are. The defaults are 0, 1641 and 3010, so the agent’s 1, 2, 20 and 21 show as errors with the code. Save the package.
4. Select Deploy Once, add the customer’s computers with Choose Targets, then select Deploy Now. The package runs as your Deploy User, which must be an administrator on the computers. There is no need to change Run As.

PDQ Connect

1. Go to Packages › Create package and name it.
2. Select Add install step, then Attach installer file and choose blink-agent.exe. In Parameters, enter --install --enroll <key>.
3. Check that Success codes does not list 1, 2, 20 or 21, so those show as failed. Then select Save.
4. On the Packages page, select the package, then Actions › Deploy. Choose the customer’s devices and select Deploy.

Caution

The key is stored in plain text in the package’s Parameters. PDQ Deploy also shows it in the step’s Command Line. Anyone who can open the package, or an exported copy of it, can read the key. Make one package per customer (one per enrollment key), and revoke the key when the rollout is done.

Switch from your old remote access tool

Put Blink on first, and remove the old tool only once each computer shows online in Blink, so you never lose access in between.

1. Roll out the Access agent with the steps above, or through the old tool itself.
2. In Blink, open Access in each organization and check that every computer shows online. See Check the rollout.
3. Remove the old tool from those computers.
4. If your RMM tool installs a remote access tool of its own (for example Splashtop or AnyDesk), turn that integration off in the RMM, or it may install the tool again.

Use the old tool to install Blink

ConnectWise ScreenConnect. Its Access agents run commands as the system account:

1. On the host page, open Access and tick the sessions of one customer.

2. Right-click them and select Run Command.

3. Enter these three lines, then the PowerShell script, with $BlinkAddress and $EnrollKey set in place of the “Lines for your tool” comment:

   #!ps
   #timeout=300000
   #maxlength=100000

   #!ps sends the command to PowerShell, #timeout gives it 5 minutes instead of the default 10 seconds, and #maxlength keeps the whole output.

4. Read each session’s output: the last line starts with Blink: and says what happened.

ScreenConnect keeps the command, key included, in the session history and the audit log, so revoke the key when the rollout is done.

Splashtop. With Splashtop Autonomous Endpoint Management (AEM), go to Automation › Scripts & Tasks and select Create Action › Batch/Executable File. Upload blink-agent.exe (see If your tool ships the file), enter --install --enroll <key> in Parameters, then select Save and Run, choose the customer’s computers and enter an administrator account for them. Use one action per customer.

Remove the old tool

Tool	How to remove it
ConnectWise ScreenConnect	On the host page, select the sessions, then Uninstall › Uninstall and Delete. Delete on its own leaves the client on the computer.
AnyDesk	"%ProgramFiles(x86)%\AnyDesk\AnyDesk.exe" --silent --remove
Splashtop Streamer	Uninstall it silently with msiexec /qn /x and the Streamer’s product code, as described in Splashtop’s own help.
TeamViewer	Use your TeamViewer management console or TeamViewer’s documented uninstall. Test any silent uninstall command on one computer first.

Check the rollout

• In Blink, open Access in each organization. Enrolled computers appear with their name, OS and agent version, and show online once the service connects. See Manage Access devices.
• In your tool, look at the job results. Anything other than exit code 0 needs a look:
  • 1: read the job output (the PowerShell script prints the end of install.log), or C:\ProgramData\Blink\install.log on the computer. Common causes: the computer cannot reach your Blink address, a security tool blocked the download, the key is wrong, used up, expired or revoked.
  • 2: the script did not receive the address or the key. Check the variable or field for that customer.
  • 20: every Access device in your plan is in use. Free one or add devices to your plan, then run the job again for the computers that failed.
  • 21: your plan does not include Unattended Access.
• Computers that enrolled but stay offline: check for a proxy or HTTPS inspection, and see Fix a Blink agent that will not connect.

Remove the agent with your tool

To take the agent off computers, run this as the system account:

"C:\ProgramData\Blink\blink-agent.exe" --uninstall

It exits with 0 on success and 1 on failure. Then revoke or delete the devices in the console. See Uninstall the Access agent.