SuperIT RMM agent requirements

Previous Next

Supported operating systems, disk space, and the network access the agent needs.

This page lists what a device and its network need before you install the SuperIT RMM agent.

Supported operating systems

Operating system Status Installer
Windows on x64 (Intel or AMD) Generally available superit-agent-amd64-<version>.msi
Windows on ARM64 Generally available superit-agent-arm64-<version>.msi
macOS Beta Contact [email protected] for beta access
Linux Beta Contact [email protected] for beta access

On Windows, the SuperIT RMM agent needs Windows 10 or Windows 11, or Windows Server 2016 or later. It doesn't run on older versions of Windows, even though the installer may finish. There is no installer for 32-bit Windows.

The macOS and Linux agents are in Beta. To join the beta, contact [email protected]. The rest of this page covers Windows.

Permissions

Task Needs
Install or uninstall Local administrator rights on the device. SYSTEM, as used by RMM tools and Intune, has them.
Generate an install key The Admin or Engineer role in the device's SuperIT team.

After installation, the SuperIT RMM agent runs as a Windows service under the LocalSystem account. It doesn't need a domain account or domain administrator rights.

Disk space

Item Size
Program files (superit-agent.exe and superit-updater.exe) about 20 to 25 MB
Logs in C:\ProgramData\SuperIT\ up to about 10 MB for the current log, plus 3 compressed older logs
Update downloads One MSI at a time in the SYSTEM account's temp folder while an update installs

Network requirements

The SuperIT RMM agent only makes outbound connections. You don't need to open any inbound ports or set up port forwarding.

Host Port Protocol Used for
connect.ngs.global 4222 TCP, TLS (NATS) Registration, telemetry, commands and their results. This is the agent's main connection to SuperIT.
connect.ngs.global 443 TCP, WebSocket over TLS (wss) Fallback for the connection above, used only when port 4222 is blocked or times out.
updates.superit.ai 443 HTTPS Checking for and downloading agent updates.
api.ipify.org 443 HTTPS Looking up the device's public IP address, once per collection (every 60 seconds by default).

To download the installer from the SuperIT app, the computer you use also needs HTTPS access to the SuperIT app and to updates.superit.ai.

If your firewall allows outbound traffic by host name, allow the hosts above. If it can only allow IP addresses, contact SuperIT support: the hosts above don't have a fixed published IP list.

Note

When the SuperIT RMM agent falls back to port 443, its log shows NATS server unreachable, attempting websocket fallback followed by connected to NATS over websocket fallback. See Troubleshoot the SuperIT RMM agent.

Proxy servers

The SuperIT RMM agent doesn't use the Windows proxy settings (WinINET or WinHTTP).

  • The connection to connect.ngs.global doesn't go through any proxy. The device must be able to reach connect.ngs.global directly on port 4222 or 443.
  • Update downloads from updates.superit.ai and the public IP lookup at api.ipify.org use the proxy in the HTTPS_PROXY environment variable, if the SuperIT service can see one. Set it as a system environment variable and restart the SuperIT service.

Security software

The SuperIT RMM agent and its installer are signed with a code signing certificate issued to Super IT Pty Ltd. If your devices run application control or EDR software, allow the agent by that certificate before you deploy, and allow:

  • C:\Program Files (x86)\SuperIT\agent\superit-agent.exe and superit-updater.exe to run
  • superit-agent.exe to start powershell.exe, which is how every command SuperIT runs on the device is started
  • superit-updater.exe to start powershell.exe and msiexec.exe, to install updates
  • read and write access to C:\ProgramData\SuperIT\

If you use ThreatLocker, follow Allow the SuperIT RMM agent in ThreatLocker. The same rules apply to other application control and EDR products.

SuperIT RMM agent overview Install the SuperIT RMM agent