User Guide

How to install Audit Agents

This guide explains how to deploy an Audit Agent to audit computers that cannot be reached through an Audit Service, such as laptops used by remote workers or computers on another network.

Prerequisites

  • Site Administrator role to obtain installer downloads.
  • An endpoint running a supported operating system:
  • Windows 10 or later, Windows Server 2016 or later.
  • macOS X 10.7 or later.
  • Linux — Debian or Red Hat-derivative distributions.
  • Outbound HTTPS (TCP 443) from the endpoint to the AlloyScan instance. No inbound ports are required.

Choose a deployment method

  • Download the package when you want to install the agent manually and can transfer the downloaded package to the endpoint.
  • Copy the package link when you want to download the package directly on the endpoint or provide its URL to an MDM or configuration-management tool.
  • Install remotely from Scan results when the computer has already been discovered in one of your Segments and appears in Scan results.

Download an Audit Agent package

Navigate to Network > Audit agents (or Admin Center > Tasks and services > Audit agents), then use one of the following options.

Download the package

In the Installing the audit agent section, download the package for the target operating system and copy it to the endpoint.

Click the copy-link icon for the target operating system, then use the copied URL to download the package on the endpoint or distribute it through an MDM or configuration-management tool.

Install manually

Windows

  1. Copy the downloaded Windows package to the endpoint and extract the ZIP archive.
  2. Run AlloyAuditAgentInstaller.msi and follow the installation prompts.

macOS

The macOS download is a universal installer for both Intel-based Macs and Macs with Apple silicon. You do not need a separate package for each processor architecture.

  1. Copy the downloaded .dmg file to the Mac.
  2. Open the .dmg file to mount it.
  3. On the mounted disk image, open AlloyMacAuditAgent.pkg and complete the standard macOS installer prompts.

Linux

  1. Copy the downloaded Linux package to the endpoint and extract the ZIP archive.
  2. In the extracted archive, open the InstallFiles directory.
  3. Run the installation script with root privileges:
cd InstallFiles
sudo /bin/bash install.sh

Install remotely from Scan results

You can remotely test and install an Audit Agent on a discovered Windows, Linux, or macOS computer from Scan results.

  1. Open Network, select the segment containing the computer, and open Scan results.
  2. Find the computer and click the troubleshooting icon in the Ready for audit column.
  3. Under Audit agent, click Install. If an agent is associated with a different Site, click Reinstall instead. Reinstalling unlinks the agent from the previous Site and sends future audit data to the current Site.
  4. In the installation panel, click Test. This checks whether AlloyScan can install the agent; it does not install software.
  5. When the test status changes to Passed, review Log, then click the final Install or Reinstall action.
  6. When the result shows Success and Ready for audit, close the panel. Confirm that the main dialog shows Audit agent: Found and that the computer is marked Ready for audit.

After deployment, use the verification steps below to confirm that the agent registered successfully.

Configure Audit Agent settings

The following settings apply to Audit Agents on all supported operating systems. Open Admin Center > Settings > Audit settings > Audit Agent to configure them:

  • Inactivity period (default 30 days) — agents that send no heartbeat for this period are automatically scheduled for deletion.
  • Audit agent auto tag — a tag applied automatically to every agent-audited device.

Uninstall an Audit Agent

Windows

Use the standard Windows uninstall process. A command-line uninstall procedure is not included here.

macOS

In the default installation directory, run:

cd /Library/AlloyMacAuditAgent
sudo ./uninstall.sh

Linux

Run:

sudo /bin/bash /opt/AlloyLinuxAuditAgent/uninstall.sh

Verify

The first audit results from a freshly installed agent typically arrive within 10 to 15 minutes. After that:

  • The agent appears in Admin Center > Tasks and services > Audit agents with a Last active timestamp and an Audit ID UUID.
  • The audited device appears in Inventory under the matching device type.
  • If you set an auto tag, the device row shows the tag pill in the Tags column.