Agent reference

At a glance

What the agent connects to

The agent only dials out. It never listens for a connection, so there is no inbound firewall rule to add. All three hosts use port 443.

We do not publish fixed IP addresses for these services, so allow the host names rather than addresses.

Besides those hosts, Windows itself checks whether certificates have been revoked. The Windows agent's process opened port 80 connections in its first minutes; one destination matched the DNS answer for ocsp.rootca1.amazontrust.com, Amazon's certificate status responder. We did not test what happens if port 80 is blocked, so we do not list it as a requirement.

Behind a proxy

The agent does not currently tunnel its standing connection through an HTTP proxy. That connection is a direct TCP connection to the host above, so a network that lets machines out only through a proxy cannot run the agent today. Allow direct outbound access to that one host.

The agent's ordinary web requests, which are the check-in, log lines and downloads, do follow a proxy where one is configured:

• On Windows they use the system proxy settings, and offer the machine's own credentials to a proxy that asks for them.
• On macOS and Linux they follow the standard HTTPS_PROXY and NO_PROXY environment variables of the agent's own process. A service manager does not pass your shell's variables on, so set them in the service definition.

Check that it is running

The machine appears in its company in the dashboard with a green dot within about a minute of the installer finishing. To check from the machine itself:

Windows

Get-Service RemediateDesk

The status should be Running and the start type Automatic.

Linux

systemctl is-active remediatedesk
journalctl -u remediatedesk -n 20 --no-pager

macOS

sudo launchctl print system/com.remediatedesk.agent

On macOS the output should include a line that says the state is running.

If the service runs but the machine never shows up, the install key was most likely wrong, expired or already used. The installer on macOS and Linux waits for the machine to register and says so if it does not.

Install without the one-line command

The one-line command in the install panel is a download, a checksum check and then a silent run of the Windows installer. If you deploy the installer yourself, the silent form takes three properties:

msiexec /i RemediateDeskAgent.msi /quiet /norestart SERVERURL=<server-address> INSTALLKEY=<install-key> MACHINENAME=<name>

Download RemediateDeskAgent.msi and its checksum file from the download host above, and compare the checksum before you run it. We ran this form on test machines for this page and the service started.

Group Policy, Intune and other deployment tools can pass the same three properties. We have not tested either of them, so this page gives no steps for them.

How updates work

The agent updates itself. Once a night, at a random minute between 03:00 and 03:59 on the machine's own clock, it reads the published version from dl.remediatedesk.com. It also checks once, between 5 and 15 minutes after the service starts, so a laptop that is switched off at night still catches up.

If the published version is newer, the update is:

• On Windows: the agent downloads the new installer, checks its SHA-256 checksum against the published value, and has a one-time scheduled task run it. The service restarts. The settings and the machine's identity are kept, so the machine does not re-register.
• On macOS and Linux: the agent downloads the new program, checks its checksum, runs it once to confirm it starts, keeps the previous copy beside it with the suffix .prev, swaps the new one in and exits. The service manager then starts the new version.

A technician can also ask a machine to update straight away, so a fix does not have to wait for the night.

What the agent sends

Four kinds of information leave the machine. The first is the routine health check, which reads only the values in the table below.

The macOS health check reports values from this same list, adapted to macOS; we did not run it. The agent checks these values every minute on the machine and reports when one changes enough to matter, or when a limit such as a full disk is crossed. If nothing has changed it still reports at least every six hours, so a quiet machine can be told from a stopped one. On Windows a separate daily check counts the updates that are available and groups them by category.

The second is who the machine is: its name, the operating system version, the agent version and a stable machine identifier, which is used to tell two computers with the same name apart.

The third is the agent's own log lines, which go to RemediateDesk so a failed update or a lost connection can be seen without visiting the machine.

The fourth is the output of the commands it is asked to run. Those are the commands you approve in the chat or that an Autopilot instruction you saved is allowed to run, and their output goes back to the conversation they belong to.

Resource use

Measured on disposable test machines on 2026-10-21. These figures describe those machines on that day only. Your results will depend on the hardware and on what the machine is doing.

When nothing is being asked of it

While answering a real question

The network figures are everything the machine carried, which includes the cloud management agent on the test machine, so they are an upper bound for the RemediateDesk agent and not a measurement of it alone.

Processor time is the time the agent's process used, not a share of the machine. The idle figures cover ordinary running and do not include an update, which downloads a new version and uses the network far more.

Every diagnostic asked the same question and was answered with one short round of read-only commands. A larger investigation will use more.

Supported systems

These are the systems we installed the agent on and watched come online, listed with what was run on each. All were disposable cloud machines, tested on 2026-10-21.

• The Windows agent is a 64-bit program built for x64. It carries its own runtime, so nothing has to be installed first.
• The Linux program is statically linked, which we checked with file and ldd on both builds we ran, so it does not depend on the distribution's C library.
• The published macOS programs for Apple silicon and Intel declare macOS 12.0 as their minimum version in their file headers, which we read with otool. We have not run them on any Mac.

Not verified: macOS, any version; Windows 10 and Windows 11 desktops; Windows on ARM; Windows Server 2012 R2 and earlier; Linux distributions other than those in the table. Their absence from the table means we have not tested them, not that they fail.

Remove the agent

The install panel shows the removal command for each system. We ran each of the following on a test machine to confirm what it leaves behind.

Windows

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-Expression "& { $(irm https://dl.remediatedesk.com/windows/uninstall.ps1) }"

Run it from an elevated PowerShell window. It uninstalls the agent and also deletes the saved settings and the machine's identity.

macOS and Linux

curl -fsSL https://dl.remediatedesk.com/uninstall.sh | sudo bash

This stops and removes the service and the program, and keeps the settings and identity in /opt/remediatedesk, so reinstalling reconnects as the same machine. Add the purge option, by ending the command with bash -s -- --purge, to delete everything.

On Windows Server 2016 the removal command printed that a restart is required to complete the uninstall; the service, the folder and the installed-product entry were already gone.