This guide provides comprehensive instructions for IT administrators to deploy the SuperIT RMM agent across their organization's devices.
Prerequisites
SuperIT Account Setup
- Organization Account: Ensure your organization has an active SuperIT subscription
- Administrator Access: You need administrative access to the SuperIT portal and to device installing the agent
- Installation key: You can generate a Installation Key inside the SuperIT platform: Devices -> Install -> Create installer key
⚠️ Security Note: Installation keys provide device enrollment access. Protect them like administrative credentials.
Network requirements
Network Requirements
Before deployment, ensure your network infrastructure supports:
Required Outbound Connections:
- HTTPS (Port 443): For secure web communication
- NATS (Port 4222): For real-time messaging
- DNS Resolution: Access to SuperIT service endpoints
Firewall Configuration:
Direction: Outbound only
Destination: *.superit.ai
Ports: 443 (HTTPS)
Protocol: TCP
Direction: Outbound only
Destination: connect.ngs.global
Ports: 4222 (NATS)
Protocol: TCP
Required permissions
Required Permissions
Installation requires:
- Local administrator rights on target devices
- Domain administrator rights for Group Policy deployment
- MDM administrative access for mobile device management
Download Agent Installer
Download the installer straight from the SuperIT portal — it always serves the latest released version:
- Log in to app.superit.ai
- Go to Devices
- Click Download
How to check your architecture
How to Check Your Architecture
Windows: 1. Open Settings → System → About 2. Look for "System type" 3. Choose x86/x64 version unless it specifically says "ARM64"
Command Line:
echo %PROCESSOR_ARCHITECTURE%
Get a specific architecture or script the download
The portal's Download button provides the standard Windows x64 installer. If you need a different architecture (for example ARM64), or want to automate the download, resolve the installer URL from the release manifest at https://updates.superit.ai/latest.json:
$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json"
# Latest version number
$latest.version
# Installer URL for a specific platform/architecture
$latest.platforms.windows.amd64.url # Windows x64
$latest.platforms.windows.arm64.url # Windows ARM64
The manifest also lists linux and darwin builds, and a SHA-256 checksum for each artifact.
Deployment Methods
Manual Installation
Recommended for testing and small deployments
Windows Installation
- Run as Administrator: Right-click installer → "Run as administrator"
- Installation Wizard: Follow the setup wizard
- Enter Installation Key: Provide the key when prompted
- Configure Options:
- Installation directory (default recommended)
- Complete Installation: Restart may be required
Command Line Installation:
Run this from the folder where you saved the installer, substituting the name of the file you downloaded:
msiexec /i superit-agent-amd64.msi INSTALLKEY="your-key" /quiet /norestart
Automated Scripts
For bulk deployment scenarios
Prerequisites and permissions
Privileges
The script installs a Windows service via msiexec.exe and requires local administrator privileges.
- Interactive: Run the PowerShell session as Administrator (elevated). If launched from a non-elevated prompt, the
msiexeccall will silently fail. - Via RMM agent (SYSTEM): SYSTEM has local admin rights — no additional elevation needed.
PowerShell version
Invoke-RestMethod requires PowerShell 3.0 or later. PowerShell 5.1 (shipped with Windows 10 / Server 2016) is recommended. Check with:
$PSVersionTable.PSVersion
Execution policy
The script must be permitted to run. Check the effective policy:
Get-ExecutionPolicy -List
Policies are evaluated per scope (MachinePolicy → UserPolicy → Process → CurrentUser → LocalMachine). When deploying via RMM, the MachinePolicy and LocalMachine scopes govern SYSTEM's session — the current user's scope is irrelevant.
To run the script directly without changing the persistent policy:
powershell.exe -ExecutionPolicy Bypass -File install-superit.ps1
TLS 1.2
Invoke-RestMethod and Invoke-WebRequest require TLS 1.2 to reach updates.superit.ai. On Windows 10 / Server 2016 and later, TLS 1.2 is the default. On older operating systems (Windows 7, Server 2008 R2, Server 2012), add this line before any web requests:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Proxy servers
- Interactive sessions use WinINET (browser/user proxy settings) automatically.
- SYSTEM sessions (RMM agent, scheduled task) use WinHTTP, which is independent of user proxy settings. If your network routes outbound HTTPS through a proxy, configure WinHTTP explicitly:
Alternatively, pass the proxy directly in the script:netsh winhttp set proxy proxy-server="http://proxy.example.com:8080" bypass-list="*.local"Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json" -Proxy "http://proxy.example.com:8080" Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath -Proxy "http://proxy.example.com:8080"
Authenticated proxies: netsh winhttp does not support proxy credentials. For proxies that require authentication, use -ProxyCredential on each web call. In a SYSTEM context there is no interactive prompt, so credentials must be supplied explicitly:
$proxyCred = New-Object System.Management.Automation.PSCredential("domain\proxyuser",
(ConvertTo-SecureString "proxypassword" -AsPlainText -Force))
$proxyUri = "http://proxy.example.com:8080"
$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json" -Proxy $proxyUri -ProxyCredential $proxyCred
Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath -Proxy $proxyUri -ProxyCredential $proxyCred
Network requirements
Outbound HTTPS (TCP 443) to updates.superit.ai must be permitted. See the Network Requirements section above for the full firewall rule set.
PowerShell Script (Windows)
# Download and install SuperIT Agent
# Log in to SuperIT, navigate to Devices in the correct team, and generate an installation key
$installKey = "your-installation-key"
# Get latest version info
$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json"
# Detect architecture — check PROCESSOR_ARCHITEW6432 first so that a 32-bit or
# AMD64-emulated PowerShell process on an ARM64 machine still gets the correct MSI
$arch = if ($env:PROCESSOR_ARCHITECTURE -eq "ARM64" -or $env:PROCESSOR_ARCHITEW6432 -eq "ARM64") { "arm64" } else { "amd64" }
$installerUrl = $latest.platforms.windows.$arch.url
if (-not $installerUrl) {
Write-Error "Could not read installer URL from latest.json (arch: $arch). Check https://updates.superit.ai/latest.json is reachable and the schema is unchanged."
exit 1
}
$installerPath = "$env:TEMP\superit-agent-$arch-$($latest.version).msi"
# Download installer
Invoke-WebRequest -Uri $installerUrl -OutFile $installerPath
# Install silently (path and key quoted to handle spaces)
Start-Process msiexec.exe -Wait -ArgumentList "/i `"$installerPath`" INSTALLKEY=`"$installKey`" /quiet /norestart"
# Verify installation (service name includes version, e.g. "SuperIT - v0.441")
if (Get-Service "SuperIT*" -ErrorAction SilentlyContinue) {
Write-Output "SuperIT Agent installed successfully"
} else {
Write-Error "Installation failed"
}
Group Policy Deployment (Windows)
Recommended for Windows environments with Active Directory
Prepare Group Policy
- Create GPO: Create a new Group Policy Object named "SuperIT Agent Deployment"
- Copy Installer: Place the latest MSI installer in a network share accessible by all computers. Download it from the portal, or fetch the current release directly onto the share:
$latest = Invoke-RestMethod -Uri "https://updates.superit.ai/latest.json" Invoke-WebRequest -Uri $latest.platforms.windows.amd64.url -OutFile "\\server\share\superit-agent-amd64.msi" - Link GPO: Link the GPO to the appropriate Organizational Units
Configure Software Installation
Computer Configuration → Policies → Software Settings → Software Installation
1. Right-click → New → Package
2. Browse to \\server\share\superit-agent-amd64.msi
3. Select "Advanced" deployment method
4. Configure properties:
- Install this application at logon: Yes
- Uninstall this application when it falls out of scope: No
Configure Installation Parameters
Create a transform file (.mst) or use command line parameters:
INSTALLKEY="your-installation-key-here"
Deploy and Monitor
- Apply GPO: Use
gpupdate /forceto apply immediately for testing - Monitor Installation: Check Event Viewer for installation success/failure
- Verify Registration: Confirm devices appear SuperIT -> Devices
Mobile Device Management (MDM)
Recommended for modern, cloud-managed environments
Microsoft Intune
- Upload App: Go to Apps → All apps → Add
- Select App Type: Choose "Line-of-business app"
- Upload Package: Upload the appropriate installer (.msi, .pkg, or .apk)
- Configure App Information:
- Name: SuperIT Agent
- Description: Intelligent IT support monitoring agent
- Publisher: SuperIT
- Configure Installation Commands (use the filename of the package you uploaded):
Install: msiexec /i superit-agent-amd64.msi INSTALLKEY="key" /quiet Uninstall: msiexec /x {product-guid} /quiet - Assign to Groups: Deploy to appropriate device or user groups
- Monitor Deployment: Use Intune reporting to track installation status
Post-Installation Verification
Checking the agent status
Windows:
sc query SuperIT
Windows powershell:
Get-Service "SuperIT*"
Reading the agent logs, these can be found here
Windows powershell:
get-content -path C:\ProgramData\SuperIT\superit.log -tail 10
Agent startup / shutdown events are published to the windows event logs
Windows logs -> Application -> Source (SuperIT)
Confirm registration through the SuperIT dashboard
- Access Dashboard: Log in to SuperIT portal
- Navigate to Devices: Go to Devices → Agent Status
- Verify Registration: Confirm new devices appear with "Online" status
- Check Data Collection: Verify system metrics are being collected
Troubleshooting
A guide to troubleshoot common errors that might be found.
no install_key or registration credentials found
When reading through the superit.log you might see this error:
failed to determine agent mode: no install_key or registration credentials found
The final configuration state will be displayed in the logs when the agent starts, here is an example:
{"time":"2025-10-15T00:30:18.4029593Z","level":"INFO","msg":"final configuration state","config":{"Log":{"Level":"INFO","FileName":"C:\\ProgramData\\SuperIT\\superit.log","MaxSize":100,"MaxBackups":3,"MaxAge":28,"Compress":true},"MetricsInterval":30,"StorageFile":"metrics.json","InstallKey":"","NATS":{"Server":"tls://connect.ngs.global","Creds":"C:\\ProgramData\\SuperIT\\ngs.creds"},"UpdateCheckIntervalSeconds":3600,"UpdateManifestURL":"https://updates.superit.ai/latest.json"}}
Check that the NATS.Creds file exists, in this case it is the value:
C:\ProgramData\SuperIT\ngs.creds
Also check that the InstallKey is not empty, in the example above it is which is the cause of the error. The install key is provided as a system enviornment variable. You can check it's existence by
get-childitem env:
And look for the SUPERIT_INSTALL_KEY value.
If this exists, then restart the service to pick it up.
Get-Service "SuperIT*" | Restart-Service
If it does not exist then you can create the variable and restart the service.
Configuration Management
Windows: C:\ProgramData\SuperIT\config.yaml
The agent uses a YAML configuration file to customize behavior. Most settings have sensible defaults and only need to be changed for specific requirements.
Configuration Priority
Settings are applied in this order (highest to lowest priority):
- Environment Variables - Override everything
- Configuration File - Custom settings in config.yaml
- System Defaults - Built-in default values
Default Configuration File
# logs:
# # options are DEBUG, INFO, WARN, ERROR
# level: WARN
# # forward slashes will need to be escaped
# file_name: "C:\\ProgramData\\SuperIT\\superit.log"
# # max_size is in megabytes, so 10 will be 10mb
# max_size: 10
# max number of log files to create
# max_backups: 3
# max_age: 28
# compress: true
# metrics_interval: in seconds
# metrics_interval: 60
# storage_file: file to store metrics on disk between intervals
# storage_file: "C:\\ProgramData\\SuperIt\\metrics.json"
# auto update
# update_check_interval_seconds: 3600 # Check for updates every hour
# update_manifest_url: "https://updates.superit.ai/latest.json"
Common Configuration Changes
Note
These are the most common scenarios for modifying the config.yaml file.
Enable debug logging
Enable Debug Logging (Troubleshooting)
logs:
level: "DEBUG"
file_name: "C:\\ProgramData\\SuperIT\\superit.log"
Adjust Metrics Collection Frequency
Adjust Metrics Collection Frequency
# Collect metrics every 2 minutes instead of default 60 seconds
metrics_interval: 120
Disable automatic updates
Disable Automatic Updates
# Disable automatic updates (not recommended for production)
update_check_interval_seconds: 0
Environment Variables (Alternative Configuration)
For environments where editing config files isn't preferred:
# Set log level for troubleshooting
setx SUPERIT_LOG_LEVEL "DEBUG" /M
Log File Locations
Windows: C:\ProgramData\SuperIT\config.yaml
Unless modified inside the config.
Scaling and Performance
Large Deployments
Deployment Phases: 1. Pilot: Deploy to 10-50 test devices 2. Staged Rollout: Deploy in batches of 500-1000 devices 3. Full Deployment: Complete organization-wide rollout
Performance Considerations: - Stagger deployment times to avoid bandwidth spikes - Monitor network utilization during initial data collection - Plan for increased support portal load during rollout
Resource Planning
Network Bandwidth: - Initial registration: ~100KB per device - Ongoing monitoring: ~10KB per device per hour - Diagnostic data: Variable, typically <1MB per incident
Storage Requirements: - Agent installation: ~100MB per device - Log retention: ~50MB per device per month - Dashboard storage: Handled by SuperIT infrastructure
Next Steps: After successful installation, learn about agent capabilities and user benefits to maximize your SuperIT deployment.