Agentbeamdocs

Start here

MDM / Getting startedDevice managementOne place to understand your Apple and Windows fleet, deliver configuration, and request device actions.MDM / Getting startedSet up your workspaceRequest MDM access, check platform readiness, and get your first managed device into inventory.Agent CLI / Getting startedAgent CLI overviewUnderstand agent activity locally, scan the files your assistants use, and connect shared workspace controls when needed.Agent CLI / Getting startedCLI quickstartInstall Beam, capture a first event, and open your local activity dashboard.Agent CLI / Getting startedConnect a workspacePair your machine through the browser or an enrollment code, then verify identity and policy synchronization.
↑ ↓ to navigate · Enter to openEsc to close
Website Open dashboard
Device management/Device response
Device response

Windows response setup

Provision a signed SYSTEM worker with a unique device credential for session disconnect and Windows reset.

On this page

The Windows response worker polls the Beam MDM service for a specific device's commands. It runs as SYSTEM and verifies a unique hardware-bound enrollment. The scripts in apps/mdm-service/windows are source files; your organization signs them before installation.

Generate a device enrollment

Verify the Fleet inventory UUID matches Win32_ComputerSystemProduct.UUID on the target. On your trusted provisioning host, generate a unique file:

Code
bun apps/mdm-service/scripts/response-enrollment.ts WORKSPACE_ID 123 INVENTORY_UUID https://mdm.example.com /secure/path/device.enrollment.json

The tool refuses to overwrite an existing file, writes an owner-readable credential file, and prints a disabled server binding containing the credential hash. Add that binding to the workspace's response.devices. Keep the enrollment file outside source control and deliver it privately to that one endpoint.

Sign and install

Authenticode-sign both scripts with your organization's trusted publisher. From an elevated PowerShell session on the target:

Code
.\Install-BeamResponse.ps1 -EnrollmentFile C:\Secure\device.enrollment.json -SignerThumbprint YOUR_CERTIFICATE_THUMBPRINT

The installer checks publisher and hardware identity, encrypts the credential with machine DPAPI, and protects %ProgramData%\BeamResponse for SYSTEM and administrators. It creates the Beam Device Response scheduled task with AllSigned, polling once per minute. Securely remove the plaintext enrollment file after verifying provisioning.

Test command delivery

Start with wipe disabled in both the server binding and local enrollment. Test session disconnect on a disposable client, confirm the device outcome, and inspect its receipt. Disconnect is temporary: it does not disable accounts or prevent another sign-in.

Uncollected commands expire after ten minutes and may be cancelled. Collection starts a single-use 60-second execution window. The worker writes a local receipt before requesting execution authorization. Once collected, cancellation is unavailable. Preserve receipts across restarts and upgrades.

Enable reset separately

Enable wipe on both sides only after validating the Windows edition, recovery environment, MDM bridge, and reset outcome on disposable hardware. The action requests a standard Windows reset through the SYSTEM-only MDM bridge; acknowledgement is not proof of completed erasure.

Suspend, rotate, or remove

Disable the server binding and scheduled task to suspend. Already-authorized OS actions cannot be revoked by disabling the binding. Before credential rotation, reconcile outstanding work, replace the protected local token and server hash through your approved procedure, preserve receipts, then re-enable.

The installer refuses to overwrite an existing directory. For removal, revoke the binding, unregister the task, archive receipts, then remove protected local files through your endpoint administration process.

Keep exploring

Explore the docs