Agentbeamdocs

Start here

MDM / Getting startedDevice managementOne place to understand your Apple and Windows fleet, deliver configuration, and request device actions.MDM / Getting startedSet up your workspaceRequest MDM access, check platform readiness, and get your first managed device into inventory.Agent CLI / Getting startedAgent CLI overviewUnderstand agent activity locally, scan the files your assistants use, and connect shared workspace controls when needed.Agent CLI / Getting startedCLI quickstartInstall Beam, capture a first event, and open your local activity dashboard.Agent CLI / Getting startedConnect a workspacePair your machine through the browser or an enrollment code, then verify identity and policy synchronization.
↑ ↓ to navigate · Enter to openEsc to close
Website Open dashboard
Device management/Manage devices
Manage devices

Enroll Windows devices

Connect a Windows endpoint using the workspace installer and a configured Windows management identity.

On this page

Windows management needs both server-side platform setup and endpoint installation. Your operator configures Fleet's WSTEP identity, then publishes a signed installer for the correct workspace. The Beam device-response worker is an additional component if you need its disconnect and reset actions.

Prepare Windows management

The Fleet engine needs its Windows MDM certificate and private key configured and backed up. The setup page reports whether the Windows identity is ready. Replacing the identity pair can affect access to previously escrowed BitLocker recovery material in the provider; follow your operator's recovery plan.

Use a supported Windows endpoint and an account authorized to install the package. The source repository contains build scripts, not universally installable, pre-signed release packages.

Install the workspace package

  1. Open Device management → Enrollment & installers.
  2. Confirm the workspace and Windows readiness.
  3. Download the Windows MSI if a published artifact is available.
  4. Check the package's Authenticode publisher using your normal endpoint deployment process.
  5. Install it on a test endpoint as an administrator. A signed-in Windows user is required for enrollment to complete.
  6. Return to Device management and verify the machine's identity, enrollment, OS, and recent check-in.

A missing download usually means an installer has not been published for this workspace. A valid service connection does not generate or sign an MSI automatically.

Add device response when needed

Windows response is provisioned separately with a signed PowerShell worker running as SYSTEM. Its enrollment file contains a unique credential bound to the hardware UUID. Do not clone a response enrollment file across devices.

The response worker's lock action disconnects active console and RDP sessions. It does not disable user accounts or prevent the user from signing back in. Wipe requests the operating system's standard reset and depends on Windows recovery support.

Verify before rollout

Test installation, OS trust, check-in, and a low-impact configuration profile first. Record the package version and publisher used in the test. Verify the response worker separately if enabled, including offline behavior and cancellation. Lock and wipe acceptance require disposable hardware tests; inventory reporting alone is not enough.

Keep exploring

Explore the docs