This guide provides comprehensive instructions for IT administrators to deploy the SuperIT RMM agent across their organization's devices.

Prerequisites

SuperIT Account Setup

  1. Organization Account: Ensure your organization has an active SuperIT subscription
  2. Administrator Access: You need administrative access to the SuperIT portal and to device installing the agent
  3. Installation key: You can generate a Installation Key inside the SuperIT platform: Devices -> Install -> Create installer key

⚠️ Security Note: Installation keys provide device enrollment access. Protect them like administrative credentials.

Network requirements

Network Requirements

Before deployment, ensure your network infrastructure supports:

Required Outbound Connections:

  1. HTTPS (Port 443): For secure web communication
  2. NATS (Port 4222): For real-time messaging
  3. DNS Resolution: Access to SuperIT service endpoints

Firewall Configuration:

Direction: Outbound only
Destination: *.superit.ai
Ports: 443 (HTTPS)
Protocol: TCP

Direction: Outbound only
Destination: connect.ngs.global
Ports: 4222 (NATS)
Protocol: TCP

Required permissions

Required Permissions

Installation requires:

  • Local administrator rights on target devices
  • Domain administrator rights for Group Policy deployment
  • MDM administrative access for mobile device management

Download Agent Installer

Download the installer straight from the SuperIT portal — it always serves the latest released version:

  1. Log in to app.superit.ai
  2. Go to Devices
  3. Click Download
How to check your architecture

How to Check Your Architecture

Windows: 1. Open Settings → System → About 2. Look for "System type" 3. Choose x86/x64 version unless it specifically says "ARM64"

Command Line:

echo %PROCESSOR_ARCHITECTURE%

Get a specific architecture or script the download

The portal's Download button provides the standard Windows x64 installer. If you need a different architecture (for example ARM64), or want to automate the download, resolve the installer URL from the release manifest at https://updates.superit.ai/latest.json:

$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json"

# Latest version number
$latest.version

# Installer URL for a specific platform/architecture
$latest.platforms.windows.amd64.url   # Windows x64
$latest.platforms.windows.arm64.url   # Windows ARM64

The manifest also lists linux and darwin builds, and a SHA-256 checksum for each artifact.

Deployment Methods

Manual Installation

Recommended for testing and small deployments

Windows Installation

  1. Run as Administrator: Right-click installer → "Run as administrator"
  2. Installation Wizard: Follow the setup wizard
  3. Enter Installation Key: Provide the key when prompted
  4. Configure Options:
  5. Installation directory (default recommended)
  6. Complete Installation: Restart may be required

Command Line Installation:

Run this from the folder where you saved the installer, substituting the name of the file you downloaded:

msiexec /i superit-agent-amd64.msi INSTALLKEY="your-key" /quiet /norestart

Automated Scripts

For bulk deployment scenarios

Prerequisites and permissions

Privileges

The script installs a Windows service via msiexec.exe and requires local administrator privileges.

  • Interactive: Run the PowerShell session as Administrator (elevated). If launched from a non-elevated prompt, the msiexec call will silently fail.
  • Via RMM agent (SYSTEM): SYSTEM has local admin rights — no additional elevation needed.

PowerShell version

Invoke-RestMethod requires PowerShell 3.0 or later. PowerShell 5.1 (shipped with Windows 10 / Server 2016) is recommended. Check with:

$PSVersionTable.PSVersion

Execution policy

The script must be permitted to run. Check the effective policy:

Get-ExecutionPolicy -List
Policies are evaluated per scope (MachinePolicy → UserPolicy → Process → CurrentUser → LocalMachine). When deploying via RMM, the MachinePolicy and LocalMachine scopes govern SYSTEM's session — the current user's scope is irrelevant.

To run the script directly without changing the persistent policy:

powershell.exe -ExecutionPolicy Bypass -File install-superit.ps1

TLS 1.2

Invoke-RestMethod and Invoke-WebRequest require TLS 1.2 to reach updates.superit.ai. On Windows 10 / Server 2016 and later, TLS 1.2 is the default. On older operating systems (Windows 7, Server 2008 R2, Server 2012), add this line before any web requests:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Proxy servers

  • Interactive sessions use WinINET (browser/user proxy settings) automatically.
  • SYSTEM sessions (RMM agent, scheduled task) use WinHTTP, which is independent of user proxy settings. If your network routes outbound HTTPS through a proxy, configure WinHTTP explicitly:
    netsh winhttp set proxy proxy-server="http://proxy.example.com:8080" bypass-list="*.local"
    Alternatively, pass the proxy directly in the script:
    Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json" -Proxy "http://proxy.example.com:8080"
    Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath -Proxy "http://proxy.example.com:8080"

Authenticated proxies: netsh winhttp does not support proxy credentials. For proxies that require authentication, use -ProxyCredential on each web call. In a SYSTEM context there is no interactive prompt, so credentials must be supplied explicitly:

$proxyCred = New-Object System.Management.Automation.PSCredential("domain\proxyuser",
    (ConvertTo-SecureString "proxypassword" -AsPlainText -Force))
$proxyUri = "http://proxy.example.com:8080"

$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json" -Proxy $proxyUri -ProxyCredential $proxyCred
Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath -Proxy $proxyUri -ProxyCredential $proxyCred

Network requirements

Outbound HTTPS (TCP 443) to updates.superit.ai must be permitted. See the Network Requirements section above for the full firewall rule set.

PowerShell Script (Windows)

# Download and install SuperIT Agent
# Log in to SuperIT, navigate to Devices in the correct team, and generate an installation key
$installKey = "your-installation-key"

# Get latest version info
$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json"

# Detect architecture — check PROCESSOR_ARCHITEW6432 first so that a 32-bit or
# AMD64-emulated PowerShell process on an ARM64 machine still gets the correct MSI
$arch = if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64" -or $env:PROCESSOR_ARCHITEW6432 -eq "ARM64") { "arm64" } else { "amd64" }
$installerUrl = $latest.platforms.windows.$arch.url
if (-not $installerUrl) {
    Write-Error "Could not read installer URL from latest.json (arch: $arch). Check https://updates.superit.ai/latest.json is reachable and the schema is unchanged."
    exit 1
}
$installerPath = "$env:TEMP\superit-agent-$arch-$($latest.version).msi"

# Download installer
Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath

# Install silently (path and key quoted to handle spaces)
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$installerPath`" INSTALLKEY=`"$installKey`" /quiet /norestart"

# Verify installation (service name includes version, e.g. "SuperIT - v0.441")
if (Get-Service "SuperIT*" -ErrorAction SilentlyContinue) {
    Write-Output "SuperIT Agent installed successfully"
} else {
    Write-Error "Installation failed"
}

Group Policy Deployment (Windows)

Recommended for Windows environments with Active Directory

Prepare Group Policy

  1. Create GPO: Create a new Group Policy Object named "SuperIT Agent Deployment"
  2. Copy Installer: Place the latest MSI installer in a network share accessible by all computers. Download it from the portal, or fetch the current release directly onto the share:
    $latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json"
    Invoke-WebRequest -Uri $latest.platforms.windows.amd64.url -OutFile "\\server\share\superit-agent-amd64.msi"
  3. Link GPO: Link the GPO to the appropriate Organizational Units

Configure Software Installation

Computer Configuration → Policies → Software Settings → Software Installation
1. Right-click → New → Package
2. Browse to \\server\share\superit-agent-amd64.msi
3. Select "Advanced" deployment method
4. Configure properties:
   - Install this application at logon: Yes
   - Uninstall this application when it falls out of scope: No

Configure Installation Parameters

Create a transform file (.mst) or use command line parameters:

INSTALLKEY="your-installation-key-here"

Deploy and Monitor

  1. Apply GPO: Use gpupdate /force to apply immediately for testing
  2. Monitor Installation: Check Event Viewer for installation success/failure
  3. Verify Registration: Confirm devices appear SuperIT -> Devices

Mobile Device Management (MDM)

Recommended for modern, cloud-managed environments

Microsoft Intune

  1. Upload App: Go to Apps → All apps → Add
  2. Select App Type: Choose "Line-of-business app"
  3. Upload Package: Upload the appropriate installer (.msi, .pkg, or .apk)
  4. Configure App Information:
  5. Name: SuperIT Agent
  6. Description: Intelligent IT support monitoring agent
  7. Publisher: SuperIT
  8. Configure Installation Commands (use the filename of the package you uploaded):
    Install: msiexec /i superit-agent-amd64.msi INSTALLKEY="key" /quiet
    Uninstall: msiexec /x {product-guid} /quiet
  9. Assign to Groups: Deploy to appropriate device or user groups
  10. Monitor Deployment: Use Intune reporting to track installation status

Post-Installation Verification

Checking the agent status

Windows:

sc query SuperIT

Windows powershell:

Get-Service "SuperIT*"

Reading the agent logs, these can be found here

Windows powershell:

get-content -path C:\ProgramData\SuperIT\superit.log -tail 10

Agent startup / shutdown events are published to the windows event logs

Windows logs -> Application -> Source (SuperIT)

Confirm registration through the SuperIT dashboard

  1. Access Dashboard: Log in to SuperIT portal
  2. Navigate to Devices: Go to Devices → Agent Status
  3. Verify Registration: Confirm new devices appear with "Online" status
  4. Check Data Collection: Verify system metrics are being collected

Troubleshooting

A guide to troubleshoot common errors that might be found.

no install_key or registration credentials found

When reading through the superit.log you might see this error:

failed to determine agent mode: no install_key or registration credentials found

The final configuration state will be displayed in the logs when the agent starts, here is an example:

{"time":"2025-10-15T00:30:18.4029593Z","level":"INFO","msg":"final configuration state","config":{"Log":{"Level":"INFO","FileName":"C:\\ProgramData\\SuperIT\\superit.log","MaxSize":100,"MaxBackups":3,"MaxAge":28,"Compress":true},"MetricsInterval":30,"StorageFile":"metrics.json","InstallKey":"","NATS":{"Server":"tls://connect.ngs.global","Creds":"C:\\ProgramData\\SuperIT\\ngs.creds"},"UpdateCheckIntervalSeconds":3600,"UpdateManifestURL":"https://updates.superit.ai/latest.json"}}

Check that the NATS.Creds file exists, in this case it is the value:

C:\ProgramData\SuperIT\ngs.creds

Also check that the InstallKey is not empty, in the example above it is which is the cause of the error. The install key is provided as a system enviornment variable. You can check it's existence by

get-childitem env: 

And look for the SUPERIT_INSTALL_KEY value. If this exists, then restart the service to pick it up.

Get-Service "SuperIT*" | Restart-Service

If it does not exist then you can create the variable and restart the service.

Configuration Management

Windows: C:\ProgramData\SuperIT\config.yaml

The agent uses a YAML configuration file to customize behavior. Most settings have sensible defaults and only need to be changed for specific requirements.

Configuration Priority

Settings are applied in this order (highest to lowest priority):

  1. Environment Variables - Override everything
  2. Configuration File - Custom settings in config.yaml
  3. System Defaults - Built-in default values

Default Configuration File

# logs:
#   # options are DEBUG, INFO, WARN, ERROR
#   level: WARN

#   # forward slashes will need to be escaped
#   file_name: "C:\\ProgramData\\SuperIT\\superit.log"

#   # max_size is in megabytes, so 10 will be 10mb
#   max_size: 10

    # max number of log files to create
#   max_backups: 3

#   max_age: 28
#   compress: true


# metrics_interval: in seconds
# metrics_interval: 60

# storage_file: file to store metrics on disk between intervals
# storage_file: "C:\\ProgramData\\SuperIt\\metrics.json"

# auto update
# update_check_interval_seconds: 3600  # Check for updates every hour
# update_manifest_url: "https://updates.superit.ai/latest.json"

Common Configuration Changes

Note

These are the most common scenarios for modifying the config.yaml file.

Enable debug logging

Enable Debug Logging (Troubleshooting)

logs:
  level: "DEBUG"
  file_name: "C:\\ProgramData\\SuperIT\\superit.log"
Adjust Metrics Collection Frequency

Adjust Metrics Collection Frequency

# Collect metrics every 2 minutes instead of default 60 seconds
metrics_interval: 120
Disable automatic updates

Disable Automatic Updates

# Disable automatic updates (not recommended for production)
update_check_interval_seconds: 0

Environment Variables (Alternative Configuration)

For environments where editing config files isn't preferred:

# Set log level for troubleshooting
setx SUPERIT_LOG_LEVEL "DEBUG" /M

Log File Locations

Windows: C:\ProgramData\SuperIT\config.yaml

Unless modified inside the config.

Scaling and Performance

Large Deployments

Deployment Phases: 1. Pilot: Deploy to 10-50 test devices 2. Staged Rollout: Deploy in batches of 500-1000 devices 3. Full Deployment: Complete organization-wide rollout

Performance Considerations: - Stagger deployment times to avoid bandwidth spikes - Monitor network utilization during initial data collection - Plan for increased support portal load during rollout

Resource Planning

Network Bandwidth: - Initial registration: ~100KB per device - Ongoing monitoring: ~10KB per device per hour - Diagnostic data: Variable, typically <1MB per incident

Storage Requirements: - Agent installation: ~100MB per device - Log retention: ~50MB per device per month - Dashboard storage: Handled by SuperIT infrastructure


Next Steps: After successful installation, learn about agent capabilities and user benefits to maximize your SuperIT deployment.