> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cystack.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Agent on Devices

> Guide to installing the Endpoint agent for device management

The **CyStack Agent** is a tool that must be installed on user devices to enable device management features.

Installing the agent takes only a few minutes and allows organizations to quickly protect and manage IT assets effectively. The process involves:

<Steps>
  <Step title="The administrator copies and sends the agent installation link to the user of the device requiring management." />

  <Step title="The employee runs the installation file on their device." />

  <Step title="After installation, device information appears on the admin dashboard. The employee logs into the agent via SSO or email." />

  <Step title="The administrator can begin monitoring and establishing policies for that device and employee." />
</Steps>

***

## 1. Install the agent on the device

<Tabs>
  <Tab title="Windows" icon="windows">
    <Steps>
      <Step title="Access the device management page on the dashboard." />

      <Step title="Select the Windows installer:">
        Click the <code>Install agent</code> button and select the Windows operating system. You can:

        * Click the <code>Download</code> button to get the installer file, or
        * Click the <code>Copy</code> button to copy the link and send it to other employees in the organization.

        <Note>When using Endpoint for the first time, you may need to wait 3–5 minutes for the system to prepare the installation file.</Note>

        <img src="https://mintcdn.com/cystack/e7ixGLpy9hH6GVF0/images/endpoint/en-agent-window-install-popup.png?fit=max&auto=format&n=e7ixGLpy9hH6GVF0&q=85&s=8c1ca36479fd6b4f8933b5b592a15e4a" alt="agent-window-install-popup" style={{display: 'block', margin: '0 auto'}} width="738" height="462" data-path="images/endpoint/en-agent-window-install-popup.png" />
      </Step>

      <Step title="Download the installer file to the target device." />

      <Step title="Double-click the file to start the installation process.">
        <img src="https://mintcdn.com/cystack/6QAuuZRXnJvVpwF2/images/endpoint/agent-installed.png?fit=max&auto=format&n=6QAuuZRXnJvVpwF2&q=85&s=46180633d61bf1003bed357a104ada5d" alt="agent-installed" style={{display: 'block', margin: '0 auto'}} width="1201" height="752" data-path="images/endpoint/agent-installed.png" />
      </Step>

      <Step title="Once installed, the application will automatically launch in the background." />
    </Steps>
  </Tab>

  <Tab title="macOS" icon="apple">
    <Steps>
      <Step title="Access the device management page on the dashboard." />

      <Step title="Select the macOS installer">
        Click the <code>Install agent</code> button and select the macOS operating system. You will see the installation command below:

        ```bash title="Installation command for macOS" theme={null}
        curl -s "https://id.cystack.net/scripts/endpoint-macos-installer.sh" | bash -s [workspace-id]
        ```
      </Step>

      <Step title={<>Click the <code>Copy</code> button to copy the command and send it to employees.</>} />

      <Step title={<>On the computer, open Spotlight Search, type <code>Terminal</code>, and open the application.</>} />

      <Step title={<>Paste the command into <code>Terminal</code> and press <code>Enter</code> to begin installation.</>} />

      <Step title="Follow the on-screen prompts to complete the process:">
        <img src="https://mintcdn.com/cystack/e7ixGLpy9hH6GVF0/images/endpoint/en-agent-install-mac.png?fit=max&auto=format&n=e7ixGLpy9hH6GVF0&q=85&s=53867700d52c51c1896d5d0879bdbba7" alt="agent-install-mac" style={{display: 'block', margin: '0 auto'}} width="1100" height="783" data-path="images/endpoint/en-agent-install-mac.png" />
      </Step>
    </Steps>
  </Tab>

  <Tab title="Linux" icon="linux">
    <Steps>
      <Step title="Access the device management page on the dashboard." />

      <Step title="Select the Linux installer">
        Click the <code>Install agent</code> button and select the Linux operating system. You can:

        * Click the <code>Download</code> button to get the installer file, or
        * Click the <code>Copy</code> button to copy the link and send it to other employees in the organization.

        <Note>When using Endpoint for the first time, you may need to wait 3–5 minutes for the system to prepare the installation file.</Note>

        <img src="https://mintcdn.com/cystack/NwFcT4Q52zfPNCn3/images/endpoint/en-popup-install-linux.png?fit=max&auto=format&n=NwFcT4Q52zfPNCn3&q=85&s=69000f36a9ac8b5c606850daa62c98f5" alt="popup-install-linux" style={{display: 'block', margin: '0 auto'}} width="842" height="470" data-path="images/endpoint/en-popup-install-linux.png" />
      </Step>

      <Step title={<>Open <code>Terminal</code>, enter the command below, and press <code>Enter</code>:</>}>
        ```bash theme={null}
        sudo dpkg -i <file.deb>
        ```
      </Step>
    </Steps>
  </Tab>
</Tabs>

## 2. Log in and authenticate devices

<Tabs>
  <Tab title="On devices with a graphical interface (GUI)">
    <Steps>
      <Step title={<>After installation is complete, a window will appear prompting you to log in.</>}>
        <img src="https://mintcdn.com/cystack/6QAuuZRXnJvVpwF2/images/endpoint/agent-login-popup.png?fit=max&auto=format&n=6QAuuZRXnJvVpwF2&q=85&s=a7f26f52ed47f4c2729edf2cceb76ff3" alt="agent-login-popup" style={{display: 'block', margin: '0 auto', maxWidth: '60%', width: '100%'}} width="924" height="1154" data-path="images/endpoint/agent-login-popup.png" />
      </Step>

      <Step title={<>Click the <code>Log in</code> button; the browser will automatically open the login page.</>}>
        <img src="https://mintcdn.com/cystack/6QAuuZRXnJvVpwF2/images/endpoint/login-CSid.png?fit=max&auto=format&n=6QAuuZRXnJvVpwF2&q=85&s=13d9adc4af3627b933c0e40ae0096632" alt="login-CSid" style={{display: 'block', margin: '0 auto'}} width="2864" height="1496" data-path="images/endpoint/login-CSid.png" />
      </Step>

      <Step title="Users can choose one of two login methods:">
        * **SSO (Single Sign-On)**: Quick login using a Google or GitHub account linked to the organization's email.
        * **Email**:
          * Enter the organization email address.
          * Receive a one-time login link via email.
          * Click the link to verify.

        After logging in, the browser will prompt you to open the app. Simply allow the request to proceed.

        <img src="https://mintcdn.com/cystack/6QAuuZRXnJvVpwF2/images/endpoint/open-agent.png?fit=max&auto=format&n=6QAuuZRXnJvVpwF2&q=85&s=80578f4bcf147ba514aa0475b5db1038" alt="open-agent" style={{display: 'block', margin: '0 auto'}} width="1275" height="599" data-path="images/endpoint/open-agent.png" />
      </Step>
    </Steps>
  </Tab>

  <Tab title="On devices without a graphical interface">
    For servers or when accessing a device remotely, you can log in using the command line:

    <Steps>
      <Step title={<>Open <code>Terminal</code>/<code>CMD</code> and type the command appropriate for your operating system (do not press <code>Enter</code> yet):</>}>
        | **OS**  | **Path**                                                                                   |
        | ------- | ------------------------------------------------------------------------------------------ |
        | Windows | `C:\Program Files\CyStack\bin\cystack_agent\windows\stable\cystack_agent login --deeplink` |
        | macOS   | `/opt/cystack/bin/cystack_agent/macos/stable/cystack_agent login --deeplink`               |
        | Linux   | `/opt/cystack/bin/cystack_agent/linux/stable/cystack_agent login --deeplink`               |
      </Step>

      <Step title="Access the login page on another device with a web browser using this link:">
        [https://id.cystack.net/?SERVICE\_URL=%2F\&SERVICE\_SCOPE=whitehub\&lang=en\&CLIENT=desktop](https://id.cystack.net/?SERVICE_URL=%2F\&SERVICE_SCOPE=whitehub\&lang=en\&CLIENT=desktop)
      </Step>

      <Step title="Select the appropriate login method (same as described in the section above)." />

      <Step title={<>On the redirect page after logging in, right-click the text "click here" and select <code>Copy link address</code>.</>}>
        <img src="https://mintcdn.com/cystack/6QAuuZRXnJvVpwF2/images/endpoint/login-without-UI.png?fit=max&auto=format&n=6QAuuZRXnJvVpwF2&q=85&s=feb6dd53eb0026b9203e8f814962ab48" alt="login-without-UI" style={{display: 'block', margin: '0 auto'}} width="2860" height="1458" data-path="images/endpoint/login-without-UI.png" />

        <Note>The copied link will look like `cystack://?token=...`</Note>
      </Step>

      <Step title={<>Paste the copied link into the end of the previous command in your terminal. <strong>Important:</strong> You must enclose the pasted link in double quotes (").</>}>
        Example on Linux:

        ```bash theme={null}
        /opt/cystack/bin/cystack_agent/linux/stable/cystack_agent login --deeplink "cystack://?token=..."
        ```
      </Step>
    </Steps>
  </Tab>
</Tabs>

## 3. Completion and connection check

<Steps>
  <Step title="Upon successful login, the device will be added to the management list on the dashboard.">
    <Note>Admins can check connection status and device information, as well as enable policies for the device and user.</Note>
  </Step>

  <Step title="The Agent will create a secure drive on the user's device to store organization data:">
    * **For new users:** A new drive will be created.
    * **For users who previously used CyStack Endpoint on another device and have a backup:** You can opt to restore data from the backup or set up a fresh drive.
    * **On Windows:** After successfully creating the new drive, you must **save the BitLocker recovery key** for future data recovery.
  </Step>
</Steps>

<Note>
  **Note:** On Windows devices, data in this drive is encrypted using [BitLocker](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/). Data protection features for macOS and Linux environments are currently under development.
</Note>

## 4. Create a non-admin local user

Administrators can create a standard local user account (without admin privileges) on the managed device for employee use. This account has restricted system access and disallows the installation of unauthorized software or changes to security configurations, ensuring the employee complies with device policies.

Follow the steps below to create a non-admin local user:

<Tabs>
  <Tab title="Windows" icon="windows">
    <Steps>
      <Step title="The administrator uses the device directly or accesses it remotely." />

      <Step title={<>Search for <code>Command Prompt</code> {'\u2192'} right-click {'\u2192'} select <code>Run as administrator</code>.</>} />

      <Step title={<>In the CMD window, type the command below and press <code>Enter</code>:</>}>
        ```bash theme={null}
        net user [local_username] [password] /add
        ```
      </Step>

      <Step title="Provide the new username and password to the employee." />

      <Step title="Subsequently, the administrator can modify the passwords of existing admin users (if necessary) to prevent the employee from using privileged accounts on the device." />
    </Steps>
  </Tab>

  <Tab title="macOS" icon="apple">
    <Steps>
      <Step title={<>Log in with an admin account on the device and open <strong>System Settings</strong>.</>} />

      <Step title={<>Search for and navigate to <strong>Users & Groups</strong>.</>} />

      <Step title={<>Click the <code>Add User</code> button.</>} />

      <Step title="Authenticate with your admin password, then enter the new user details:">
        * **Account Type:** Select <code>Standard</code>.
        * Enter **Account Name** and **Password**.
      </Step>

      <Step title={<>Finalize the information and click <code>Create User</code>.</>} />

      <Step title="Provide the new username and password to the employee." />

      <Step title="Subsequently, the administrator can modify the passwords of existing admin users (if necessary) to prevent the employee from using privileged accounts on the device." />
    </Steps>
  </Tab>
</Tabs>