Enrollment Links & Tokens

Every agent install needs an enrollment token. You can either copy the install command yourself, or share a link that lets someone else install it without ever logging into your dashboard.

Sharing a link

On the Deploy Agent page, copy the short link shown (guardian.gtarsenals.com/e/<code>). Anyone who opens it:

• Sees the right install command for their OS automatically.
• Can download the Windows installer or copy the Linux/macOS/Docker command.
• Never sees your dashboard or needs an account.

This is the fastest way to onboard a remote employee or contractor — send the link, they run one command, the device shows up in your fleet.

The link shows how many device slots are left if fewer than 20 remain, and stops working once the token expires or is revoked.

Managing tokens

Go to Settings → Add Device to create tokens with more control than the quick “Deploy Agent” flow:

• Label — so you can tell tokens apart later.
• Max agents — how many devices can enroll with this one token (1–1000, default 1).
• Expiry — 1–365 days (default 30).
• Devices enrolled are — the ownership mode (Dedicated, Shared, Kiosk, Infrastructure or Unassigned) recorded for every device that enrolls with this token.
• Environment and Release channel (Stable, Early access, Canary) — recorded the same way. These come from the token, so whoever issues it decides them, not the machine.
• Auto-assign to a group — devices enrolled with this token land directly in a department/group, skipping a manual move afterward.

Rollout progress

Each token in Settings → Add Device shows a progress bar: how many devices have enrolled out of its limit, how many of those are online, and how many have since been revoked. The numbers come from the devices that actually enrolled with that token, so a rollout in stages is easy to follow. Using a separate token per wave lets you follow a staged rollout wave by wave.

Release channels decide which agent version a device is offered. A device on Stable only receives releases that have been promoted to Stable. Early access devices also receive Early builds, and Canary devices receive every build, including ones not yet promoted. So you can try a new agent build on a few Canary machines first, then promote it outward. Releases published before channels existed are Stable, so nothing changes for existing devices. Builds tagged as pre-releases (for example 1.4.0-rc1) are published to Canary only; a plain version tag publishes as Stable. Channels apply to the version a device fetches when it updates; updates themselves are still queued per device and approved in Pending Actions.

How limits and reinstalls behave

• Limits hold during a mass rollout. The token’s device limit and your plan’s device limit are checked inside a single locked transaction, so enrolling many machines at once can never exceed either.
• Reinstalling is safe. Enrolling a device that is already in your fleet (a reinstall or a retried install) does not use up a token slot or a plan slot. It keeps its name and history, and its credentials are rotated.
• A token only works for its own organization. If a device identity is already registered to a different organization, the enrollment is refused (HTTP 409) and the other organization’s device is not modified. The refusal is recorded in the audit log.
• Enrollments and re-enrollments are both audited. Tokens and agent keys are never written to the audit log.

Tokens can be revoked at any time from the same page — this immediately invalidates any install links or commands built from it, without affecting devices that already enrolled.

Key rotation

Each installed agent’s secret key is replaced automatically every 90 days, with no action from you. The agent checks once a day, saves the new key to disk before using it, and carries on. The old key keeps working for 24 hours afterwards, so a machine that was switched off or lost the reply on a bad network cannot be locked out. Revoking or retiring a device cancels both keys at once. Self-hosted: set AGENT_KEY_ROTATION_DAYS on the hub (0 turns rotation off).

Unattended install for many Windows machines

In Settings → Add Device, choose Windows (silent / GPO) for a command that downloads the installer and runs it with no prompts, then waits for it to finish and returns its real exit code. That makes it suitable for a Group Policy startup script, Intune, SCCM or any scripted rollout. It uses the installer’s /S (silent) switch and passes the token with /TOKEN=:

Start-Process .\GTGuardian-Setup.exe -ArgumentList '/S','/TOKEN=ENR-your-token' -Wait

Use a token with a Max agents limit that matches the size of the rollout, and a separate token per wave. Progress shows on the token as machines enroll. If the same machine runs the installer twice, it is not counted twice.