Skip to main content

Agent Installation

The One RMM uses a unified agent — a single binary that runs on Windows, macOS, and Linux. Additional product modules (Defend EDR, Backups) are loaded automatically at runtime based on your Hub subscription. There is no need to install separate agents.

Unified Agent Architecture​

The agent checks your organization's active subscriptions on enrollment and at each startup. The appropriate modules are loaded:

ModuleRequires
RMMRMM subscription (always active if agent is installed)
DefendDefend EDR subscription
BackupsBackups subscription

When you add a new subscription in Hub, the agent loads the new module on its next heartbeat — no reinstallation required.

Windows​

Interactive Install​

  1. Download the .msi installer from Devices → Add Devices in the RMM console.
  2. Double-click TheOneRMM-Agent.msi and follow the wizard.
  3. The agent installs as a Windows service (TheOneRMMAgent) set to Automatic start.

Silent Command-Line Install​

msiexec /i TheOneRMM-Agent.msi /quiet ENROLLMENT_TOKEN="your-token-here"

The enrollment token is pre-embedded in downloads from the console, so you typically do not need to pass it manually unless you are scripting a custom deployment.

Group Policy Deployment​

To deploy to all domain-joined Windows devices via Group Policy:

  1. Copy TheOneRMM-Agent.msi to a UNC share accessible by all target machines (e.g., \\fileserver\rmm\TheOneRMM-Agent.msi).
  2. Open Group Policy Management Console.
  3. Create or edit a GPO linked to the target OU.
  4. Navigate to Computer Configuration → Policies → Software Settings → Software Installation.
  5. Right-click → New → Package, point to the UNC path, and select Assigned.
  6. The MSI deploys on next Group Policy refresh (typically at next reboot or gpupdate /force).
Silent Enrollment

For Group Policy deployments the enrollment token is embedded in the MSI. No additional configuration is needed.

Uninstalling on Windows​

Via Control Panel or:

msiexec /x TheOneRMM-Agent.msi /quiet

macOS​

Interactive Install​

  1. Download the .pkg installer from Devices → Add Devices.
  2. Double-click TheOneRMM-Agent.pkg and follow the wizard.
  3. The agent installs as a launchd daemon and starts immediately.
Gatekeeper

If macOS blocks the installer ("unidentified developer"), open System Settings → Privacy & Security and click Open Anyway. For MDM deployments use a provisioning profile to bypass Gatekeeper automatically.

MDM Deployment (Jamf)​

  1. Upload TheOneRMM-Agent.pkg to Jamf Pro as a package.
  2. Create a new Policy with the package as the payload.
  3. Set the trigger to Enrollment Complete and scope to the target device group.
  4. Deploy the policy. The agent installs silently with no user interaction.

MDM Deployment (Microsoft Intune)​

  1. Wrap the .pkg as an .intunemac file using the Intune App Wrapping Tool.
  2. Upload to Intune → Apps → macOS Apps → Add.
  3. Assign to the target device group.
  4. Intune deploys the agent during next device check-in.

Uninstalling on macOS​

sudo /Library/Application\ Support/TheOneRMM/uninstall.sh

Linux​

Supported Distributions​

DistributionMinimum VersionPackage Type
Ubuntu20.04 LTS.deb
Debian11.deb
RHEL / CentOS / Rocky8.rpm
Fedora36+.rpm
Amazon Linux2.rpm

Debian / Ubuntu Install​

# Download the package
curl -fsSL https://api.theonermm.app/rmm/agents/download/linux-deb -o theonermm-agent.deb

# Install
sudo dpkg -i theonermm-agent.deb

# Start and enable the service
sudo systemctl enable --now theonermm-agent

RHEL / CentOS / Rocky / Fedora Install​

# Download the package
curl -fsSL https://api.theonermm.app/rmm/agents/download/linux-rpm -o theonermm-agent.rpm

# Install
sudo rpm -i theonermm-agent.rpm

# Start and enable the service
sudo systemctl enable --now theonermm-agent

Uninstalling on Linux​

# Debian/Ubuntu
sudo dpkg -r theonermm-agent

# RHEL/CentOS/Rocky/Fedora
sudo rpm -e theonermm-agent

Verifying Successful Enrollment​

After installation, verify the device enrolled correctly:

  1. Open the RMM console and navigate to Devices.
  2. The device should appear within 1–2 minutes with status Online.
  3. Click the device name and confirm:
    • Correct hostname, OS, and IP address
    • Agent Version is populated
    • Modules section shows RMM as active

To verify from the device itself:

Windows:

sc query TheOneRMMAgent

Expected output includes STATE: 4 RUNNING.

macOS/Linux:

sudo systemctl status theonermm-agent
# or on macOS:
sudo launchctl list | grep theonermm

Enrollment Tokens​

Each download from the RMM console contains a pre-embedded enrollment token that:

  • Identifies your tenant
  • Authorizes the device to join your organization
  • Expires after 30 days if unused (re-download for a fresh token)

To manage enrollment tokens, navigate to Settings → Enrollment Tokens in the RMM console.

Re-Enrollment (Replacement Device)​

When replacing a device:

  1. Install the agent on the new device as normal.
  2. The agent sends a hardware_fingerprint derived from the device's hardware identifiers.
  3. If the fingerprint matches an existing (retired or offline) device record, the console prompts you to re-associate.
  4. Accept the re-association to preserve historical monitoring data and alert history.
  5. Manually retire the old device record via Device Detail → Retire Device.

Offline Enrollment (Air-Gapped Networks)​

For devices without internet access:

  1. Download the installer on a connected machine and transfer it to the air-gapped network.
  2. Install normally. The agent queues enrollment data locally.
  3. When the device gains temporary internet access, enrollment completes automatically.
Limited Functionality

Devices that are permanently air-gapped cannot send monitoring telemetry or receive remote commands. Patch management and script execution are also unavailable without connectivity to api.theonermm.app.