Installation Guide

This guide covers installing the CtrlOne agent on a single Windows PC - the right first step before a fleet-wide deployment. It assumes you already have an operator account and a tenant.

Before you begin

  • An operator account in the admin console with permission to download installers.
  • A tenant to enroll the device into, and its claim key.
  • Local administrator rights on the target Windows PC.
  • Network access from the PC to your console (cloud or LAN server).

Download the installer

Installers are generated per tenant so the agent knows which console and tenant to report to. Download the current build from the console's downloads area (or the onboarding wizard). The installer is code-signed and carries your tenant's claim configuration.

Run the installer

Run the setup with administrator rights. It installs the agent, registers the Windows service and its companion watchdog, and claims the device into your tenant. When it finishes, the PC begins checking in to the console.

For scripted or fleet deployment you can run the NSIS installer silently. Silent mode suppresses the wizard UI so you can push it through your existing deployment tooling.

REM Run elevated. /S is the NSIS silent switch.
CtrlOne-Setup.exe /S

Confirm the device checked in

Open the console and look for the new device in the devices list for your tenant. Once it appears and reports a recent check-in, the agent is healthy and ready to receive a policy.

Uninstalling

The agent is tamper-resistant by design, so uninstalling is a deliberate action. Agents installed with an uninstall credential require that password to remove. Removal cleans up the policies CtrlOne applied so the machine returns to its prior state.

Install the agent on one PC

  1. Download - Grab the current installer for your tenant from the console downloads area or onboarding wizard.
  2. Elevate - Copy it to the target PC and run it as an administrator.
  3. Complete setup - Let it install the service and watchdog and claim the device into your tenant.
  4. Verify - Check the console devices list and confirm the PC shows a recent check-in.

Frequently asked questions

Can I deploy silently across many machines?

Yes. Run the installer with the NSIS silent switch through your deployment tooling. See the Agent Deployment guide for fleet patterns.

Does the agent survive reboots?

Yes. It runs as a Windows service with a companion watchdog and re-asserts its policy after restarts, including offline fail-closed behaviour where configured.

What if the device never appears in the console?

Confirm the PC can reach the console URL and that you used a current installer for the right tenant. The Troubleshooting guide covers check-in failures.

Rolling out to a fleet?

Once one PC is healthy, move on to the agent deployment guide for mass-deployment and policy-template patterns.