What the Devices roster shows
Every machine you know about sits in one list, whether our agent is on it or another system told us about it. The two columns on the right are how you tell which is which and what you can do about it.
Roster, Unapproved, and the bar above the list
Roster is every machine that is already trusted. Unapproved counts the ones still waiting for a person to say yes, and the tab reads zero when there are none. Search, Client and Status stay on the bar because nearly every question uses one of the three. Everything else is behind Filters.
The columns
Status, the machine and its operating system, Health, the client it belongs to, Agent, Security, Control, when it last checked in, and the menu at the end of the row.
Browse
On this page
The full column set
Control
Look at the Control column, which sits between the Security column and the Last check-in column. It launches a remote-control session on that one machine, right from the row - no separate console to open first. A logo with a small green dot means your team's connected remote-access tool is on this machine and ready: click it to launch. A dimmed logo means that same tool is on the machine but was installed by someone outside your team, so nothing here can launch it. An empty cell means no remote-access tool is on the machine at all - true of every row here, since this roster has no devices yet.
Install agent, opened
EXE, MSI and Linux installer
The EXE installer, MSI installer and Linux installer rows are three rows, each collapsed behind a caret with Download always at the right - the hint and, for MSI and Linux, the exact command sit behind the caret. All three carry the same enrol link rather than a bare key: one signed installer serves every client, so the link has to say which one - it carries this client's address, the install credential, and the certificate the agent should trust, and the agent refuses any address outside agents.ezcyber.app, so from that first visit on it only ever talks to that one address and only ever trusts that one certificate, never an impostor. That first visit is also where the device picks up your company name, the client's name, and your logo, which is what the agent shows from then on. A silent MSI push runs: msiexec /i GoTenixAgent.msi /qn ADDDESKTOPICON=1 ENROLLURL="<link>" - ENROLLURL is the one that matters and is required (a fresh machine refuses the install without it), ADDDESKTOPICON=1 is an optional desktop shortcut (named "Get Support" unless you changed it) you can drop for a silent push, and /qn just means no window. Linux is one line, run as root: curl -fsSL "<link>?platform=linux&asset=install" | sudo bash - it downloads the binary, writes the config, and installs the systemd service for you; quote the link on either platform, since it can hold characters a shell would otherwise split on. The exe's own -enroll-url, -yes, -base and -token flags only matter for a hand-run or scripted install - a real MSI push never sets any of them, since msiexec passes no command-line arguments of its own; Windows Installer keeps its own exit code instead. Whichever exe flags you use still need an elevated or SYSTEM context - an ordinary prompt just gets stopped for a permission dialog no unattended job can answer - and a scripted install should wait for the exit code (start /wait, or Start-Process -Wait) and read it: 0 is connected, 10 means the credential was refused or has expired, 11 means the device could not have a real talk with the portal (DNS, a firewall, a proxy, or TLS inspection), 12 means the agent itself failed or the install had no portal details at all, and 13 means it is still trying, not a failure - the device may still show up soon.
Install key
In the Install key row at the bottom of the dialog: the same durable, permanent credential the client's own Devices tab shows: copy it here, or follow Manage keys to regenerate it, add a named key, or reach the one-time link instead. Use the install key for almost everything - it never expires. The default key only offers Regenerate; it can never be revoked, so it keeps working no matter what. Add a named key instead when a push might leak the key, such as a GPO or Intune rollout - a named key gets its own Revoke button too. Reach for the one-time install link only for a single, one-off install: it self-expires in 24 hours and works exactly once, where the install key keeps working no matter how many machines use it - a second try, or a late one, fails.
Why it works this way: What the Devices roster shows
One roster, not two, is the point. A machine another system knows about and a machine our agent is on sit in the same list, in the same order, so nobody has to remember which tool holds which fleet.
The Agent column is what tells you why an action is missing. A menu with no Run script on it is not a permission problem, it is a machine with nothing of ours installed.
The vendor mark and our own shield are shown together, not either/or, so a machine that both our agent and another system know about carries both marks.
Other ways to do this: What the Devices roster shows
From a client's own Devices tab
Open the client, then Devices.
By web address
Set a filter, then copy the address out of the bar.
Questions this page answers
What does the Agent column mean?
It says whose software is on the machine, as a small mark. Our own shield means our agent is installed and talking to us. Hover the shield to read the version. A vendor logo, such as NinjaOne, means another system also knows about the machine. That logo only shows while the integration stays connected - disconnect it in Settings and the logo goes away, even though the device still remembers the link underneath, and it comes right back the moment you reconnect. A device can carry both at once - if we have our own agent AND a vendor also reports the same machine, both marks show together. An empty cell means nothing is on it at all. To put our agent on a machine, open the row menu at the right and pick "Install agent". It opens the installer with that machine's client already picked. Click the Agent heading to sort with our own agents first. A machine that is behind the newest agent version in your fleet shows that in the Health column, not here.
Why does a computer say we do not manage it?
Our agent is not on it. That machine came in from another system, so we can read about it but we cannot run anything on it. Policies only reach machines with our agent. Install the agent from the customer's Devices tab and it will pick up a policy.
Why is it an enrol URL and not just a key?
Because a key alone does not say which portal to join. Every managed company has its own address, like yourcompany.agents.ezcyber.app. One signed installer serves every company, so it needs to be told which one. The link carries both: the address and the key, in one piece. It also carries the certificate the portal pins to that address, so the device only ever trusts the real portal, never an impostor. The agent refuses any address outside agents.ezcyber.app, so a bad link cannot send it somewhere else.
What is inside the enrol URL?
Two things: the portal's address, then either a one-time link or an install key. The device visits that address once, right after install. The portal sends back the address to join, your company name, the client's name, your logo, and a certificate to trust. From then on, the agent only talks to that one address. It only trusts that one certificate too.
What do the MSI switches do?
ENROLLURL is the one that matters. It carries the link from "Generate agent installer", or from a client's "Install Keys" card, and it is required. Leave it off a fresh machine and the install refuses, with a plain message, before anything is written. ADDDESKTOPICON=1 turns on one optional desktop shortcut for support, named "Get Support" unless you changed it. Leave it off and no icon appears; that is the default for a silent push. /qn just means run with no window. Nothing else needs setting. ENROLLURL being present does not mean the machine actually enrolled. The install waits up to 90 seconds for that. If the link is bad, or the network blocks it, the service and its files still get installed, but msiexec still calls the whole install failed, with its own code 1603, while the agent keeps trying to connect on its own.
Single-use link or durable install key - which one?
Use an install key for almost everything. It lives on the client's "Install Keys" card and never expires. The default key only offers "Regenerate" - it can never be revoked, so it keeps working no matter what. Use "Add named key" instead when a push might leak the key, such as a GPO or Intune rollout; a named key gets its own "Revoke" button too. Reach for "One-time install link (advanced)" only for a single install. It expires in 24 hours and works exactly once. A second try, or a late one, fails.
How do I install the agent on Linux?
One line, run as root: curl -fsSL "<link>?platform=linux&asset=install" | sudo bash. It downloads the binary, writes the config, and installs the systemd service for you. Quote the link the same way you would on Windows; it can hold characters your shell would otherwise split on.
What do the exe's install flags do?
These only matter when you run the installer .exe by hand or from a script. msiexec never returns them; Windows Installer keeps its own exit code instead. -enroll-url "<link>" points a scripted install at the same link the portal gives you. -yes skips the confirm prompt, so it never waits for a click. -base "<address>" with -token "<key>" is the same idea, split into two parts, for a tool that already stores them apart. All three still need an elevated or SYSTEM context. Run one from an ordinary prompt and Windows stops it for a permission prompt no unattended job can answer. A scripted install then exits with a code your tool can read (use start /wait, or Start-Process -Wait, to catch it). 0 is connected. 10 means the credential was refused or has expired; get a fresh one and run that instead. 11 means the device could not have a real talk with the portal: DNS, a firewall, a proxy, or TLS inspection. 12 means the agent itself failed, or the install had no portal details at all. 13 means it is still trying; that is not a failure, and the device may still show up soon. When the enrolment fails, the installer also writes an error to Event Viewer, Application log, source "GoTenix Agent", event ID 1700. Give -yes, or -enroll-url, or -base together with -token, and the setup window never opens at all; the install goes straight to work. Leave all of them out and the window still opens, so a person can click through it by hand. Type a switch the install does not know, such as a misspelled one, and it stops right away with exit code 2, before anything gets installed.
Was this helpful?