Moorfox
Add a device to Moorfox
Add device is a short wizard: pick the operating system, then pick how you want to install. Easy downloads an installer with an enrollment code already inside it, so there is nothing to type on the machine. Advanced gives you the one-line PowerShell or shell command, with a choice of single-device or fleet token.
Either way the machine appears in your device list within a few seconds. You need to be an admin in the organisation to add devices, and administrator or root on the machine itself.
Open the Add device screen
The Add device button sits in the top right of the dashboard, on every page. It is only shown to admins, because enrolling a machine is what makes it yours, and that is not a decision a read-only technician should be making.
Step 1: which operating system?
The wizard asks what you are enrolling before it offers you anything, because the installer and the command differ per platform and there is no reason to show you both.
| Choice | Covers |
|---|---|
| Windows | Windows 10, 11 and Server 2016 or later, 64-bit. |
| Linux | Any systemd distribution, x86-64 or ARM64. |
Step 2: Easy or Advanced?
The second step is about how much you want to type on the far machine, not about how much you get. Both paths install the same agent and end with the same device in your list.
| Easy | Advanced | |
|---|---|---|
| What you send | An installer file to run | A one-line command to paste |
| On the machine | Double-click on Windows, run it on Linux | An elevated PowerShell, or a terminal with sudo |
| Machines per go | One | One, or a whole estate with a fleet token |
| Reach for it when | A person is at the computer, or you are sending a file to somebody non-technical | You are scripting a rollout, pushing through another RMM, or on a headless server |
Easy: download and run the installer
The button downloads a MoorfoxSetup file with a fresh
single-use enrollment code already inside it, valid for an hour. Nothing is
minted until you click: opening the page costs nothing, and every click
gives you a new installer with its own code, so it can only ever add one
computer to your organisation.
Send the file however you like, but do not rename it. The enrollment code travels in the filename on signed builds, so a renamed installer arrives with nothing to enrol against.
The installer is signed
Every Moorfox binary we publish is code-signed through Microsoft Azure Artifact Signing on a publicly trusted certificate, so Windows can verify who published it before it runs. The signature is timestamped, which means it stays valid after the certificate itself rotates.
This is worth knowing precisely, because it is a check your customer can make and a thing a scammer cannot fake:
| Prompt | What signing changes |
|---|---|
| User Account Control | The blue dialog naming DevSmooth Software Inc. as a verified publisher, rather than the yellow Unknown publisher one. This is the one to point at on the phone. |
| SmartScreen | May still appear. Signing alone does not remove it — Microsoft clears it on reputation, which builds as a given release is downloaded and behaves. It is expected on a new release and fades as that build spreads. |
Signing is not the only check. The Advanced one-liner verifies the agent's SHA-256 checksum before it runs anything, and the installed agent checks the checksum of every update it downloads before swapping itself, so a later update is verified the same way the first install was.
On Windows the person at the machine opens the downloaded file and answers two prompts. The wizard draws both, so you can talk somebody through them without seeing their screen:
| They see | They click |
|---|---|
| Windows protected your PC (SmartScreen) | More info, then Run anyway. It appears for any newly downloaded program and may not appear at all. |
| Do you want to allow this app to make changes? (UAC) | Yes. On a locked-down machine it asks for an administrator password first. |
| A black window, then Moorfox agent installed | OK. The machine is enrolled and the agent is already running. |
On Linux the file is run from a terminal instead, which the wizard also spells out. One caveat worth knowing before you send it: the Easy installer expects the X11 client libraries to be present. On a headless server that has never had a desktop, use Advanced instead — its script installs those libraries as part of the run.
Advanced: the one-line command
The Advanced step mints a token as soon as you open it and builds the command around it. Copy the whole line; it carries both your organisation and the address of your Moorfox server.
Choose a token type
Two kinds, and the difference is only how many machines the command works on:
| Token | Valid for | Machines | Use it when |
|---|---|---|---|
| One device | 1 hour | One | You are enrolling one machine, which is nearly always. |
| Many devices (fleet) | 2 hours | Unlimited | You are onboarding many machines at once, typically pushing the command through the RMM you are migrating away from. |
Single use is the default, and the safer habit: it stops working the moment it has enrolled its machine, so a command left in a chat log or a ticket is not an open door into your organisation. Choose Many devices deliberately, and revoke it when the rollout is done rather than waiting out its two hours.
Where to run it
On Windows, in an elevated PowerShell: press Start, type PowerShell, right-click Windows PowerShell and choose Run as administrator. Paste with a right-click and press Enter.
iwr https://app.moorfox.com/install.ps1 -UseBasicParsing | iex; Install-Moorfox -Token <your-token>
On Linux, in a terminal on the machine or over SSH. It needs
sudo because the agent installs as a system service:
curl -fsSL https://app.moorfox.com/install.sh | sudo sh -s -- --token <your-token>
Copy the command from the dashboard rather than from this page: the one above is missing your token. The installer verifies the agent's checksum before it runs anything, then installs the agent as a service so it starts with the machine and reconnects on its own.
The agent connects outward to Moorfox over HTTPS. There are no inbound ports to open and no VPN to build, which is what makes machines behind home routers and client firewalls reachable without touching anyone's network.
Check it arrived
Go back to Devices. The new machine appears within a few seconds, carrying a green online pill, its hostname, the signed-in user and its OS. The list refreshes itself every five seconds, so there is nothing to reload.
The security score and the software, users and network inventory arrive a moment later, once the agent has finished its first collection. A blank score on a device enrolled seconds ago is normal.
Manage and revoke tokens
Every token that can still enrol a machine is listed under Active tokens, at the bottom of the Advanced step, with who created it, how long it has left and when it was last used. Codes baked into Easy installer downloads are listed there too, so a file you sent and then thought better of can be killed the same way.
Revoke takes effect immediately. Devices that have already enrolled with that token are unaffected: enrolment is a one-time handshake, and the machine's identity does not depend on the token afterwards.
Reinstalling or removing the agent
To repair an agent on a machine you already have, use Actions then Reinstall on the device's own page rather than enrolling it again. That gives you a command which replaces the binary while keeping the device's identity, so its history, inventory and score stay on the same page.
To remove the agent entirely, run the uninstall form of the installer on the machine:
iwr https://app.moorfox.com/install.ps1 -UseBasicParsing | iex; Uninstall-Moorfox
curl -fsSL https://app.moorfox.com/install.sh | sudo sh -s -- --uninstall
Troubleshooting
| Symptom | Likely cause |
|---|---|
| The installer says there is nothing to enrol against | The file was renamed after downloading, which strips the enrollment code. Download a fresh one and send it as-is. |
| The command fails with an authorisation error | The token has expired, been revoked, or a single-use token has already enrolled a machine. Create a new one. |
| The command fails on Windows with an access error | The PowerShell session is not elevated. Close it and start one with Run as administrator. |
| Windows blocks the installer and there is no Run anyway | SmartScreen is enforced by policy on that machine. Use Advanced instead. |
| The Easy installer fails on a Linux server with a missing library | A headless machine without the X11 client libraries. Use Advanced, whose script installs them. |
| The device never appears | The machine cannot reach the Moorfox endpoint over HTTPS. Check outbound access and any TLS-inspecting proxy on the network. |
| The device appears then goes offline | The agent installed but the service is not starting. Open the device page and read the Logs tab, which is served from stored logs and works while the device is offline. |
Next: connect to the machine and use the RMM tools, or sort it into a group and tag it.
Moorfox is remote monitoring and management without the enterprise tax.
One agent, one dashboard, remote desktop and a real terminal on every machine you look after.