Documentation

Add a device to Moorfox

Open the Add device screen

The Add device button sits in the top right of the dashboard, on every page. It is only shown to people who hold the Add devices permission, because enrolling a machine is what makes it yours. Admins always hold it; a technician gets it when an admin ticks it for them.

Step 1: which operating system?

The wizard asks what you are enrolling before it offers you anything, because the installer and the command differ per platform and there is no reason to show you both.

Step 2: Easy or Advanced?

The second step is about how much you want to type on the far machine, not about how much you get. Both paths install the same agent and end with the same device in your list.

Easy: download and run the installer

The button downloads a MoorfoxSetup file with a fresh single-use enrollment code already inside it, valid for an hour. Nothing is minted until you click: opening the page costs nothing, and every click gives you a new installer with its own code, so it can only ever add one computer to your organisation.

The installer is signed

Every Moorfox binary we publish is code-signed through Microsoft Azure Artifact Signing on a publicly trusted certificate, so Windows can verify who published it before it runs. The signature is timestamped, which means it stays valid after the certificate itself rotates.

This is worth knowing precisely, because it is a check your customer can make and a thing a scammer cannot fake:

Confirming your organisation

Before anything is enrolled, the installer shows one more window: it names the organisation that is about to be able to manage the computer and lists what that means — seeing its software and settings, running remote sessions, and installing software. The person at the keyboard reads it and presses Install. The button is held for a few seconds first, so it cannot be clicked through by reflex, and Cancel is the default, so a stray keypress — or an installer run by something automated — never enrols the machine.

On Windows the person at the machine opens the downloaded file and answers a few prompts. The wizard draws them all, so you can talk somebody through them without seeing their screen:

On Linux the file is run from a terminal instead, which the wizard also spells out. One caveat worth knowing before you send it: the Easy installer expects the X11 client libraries to be present. On a headless server that has never had a desktop, use Advanced instead — its script installs those libraries as part of the run.

Advanced: the one-line command

The Advanced step mints a token as soon as you open it and builds the command around it. Copy the whole line; it carries both your organisation and the address of your Moorfox server.

Choose a token type

Two kinds, and the difference is only how many machines the command works on:

Single use is the default, and the safer habit: it stops working the moment it has enrolled its machine, so a command left in a chat log or a ticket is not an open door into your organisation. Choose Many devices deliberately, and revoke it when the rollout is done rather than waiting out its two hours.

Where to run it

On Windows the command installs without anything appearing on the machine, so it needs mass deploy; until then, use Easy. With it, run the command in an elevated PowerShell: press Start, type PowerShell, right-click Windows PowerShell and choose Run as administrator. Paste with a right-click and press Enter.

iwr https://app.moorfox.com/install.ps1 -UseBasicParsing | iex; Install-Moorfox -Token <your-token>

On Linux, in a terminal on the machine or over SSH. It needs sudo because the agent installs as a system service:

curl -fsSL https://app.moorfox.com/install.sh | sudo sh -s -- --token <your-token>

Copy the command from the dashboard rather than from this page: the one above is missing your token. The installer verifies the agent's checksum before it runs anything, then installs the agent as a service so it starts with the machine and reconnects on its own.

Check it arrived

Go back to Devices. The new machine appears within a few seconds, carrying a green online pill, its hostname, the signed-in user and its OS. The list refreshes itself every five seconds, so there is nothing to reload.

The security score and the software, users and network inventory arrive a moment later, once the agent has finished its first collection. A blank score on a device enrolled seconds ago is normal.

Manage and revoke tokens

Every token that can still enrol a machine is listed under Active tokens, at the bottom of the Advanced step, with who created it, how long it has left and when it was last used. Codes baked into Easy installer downloads are listed there too, so a file you sent and then thought better of can be killed the same way.

Revoke takes effect immediately. Devices that have already enrolled with that token are unaffected: enrolment is a one-time handshake, and the machine's identity does not depend on the token afterwards.

New accounts: verification

A newly opened organisation cannot take screenshots or use the User Curtain in a remote session until it is verified. Open Settings > Verification and either add a card, which unlocks at once, or send your business details (company and registered name, registration number and address), which our team reviews, usually within one working day. The card is never charged and does not put you on a paid plan; it helps if the name on it matches your company or your own name.

Installing at scale: mass deploy

Installing on many computers at once is switched on per organisation by the Moorfox team, so Moorfox cannot be signed up for and pushed silently onto strangers' computers. Until it is on, whether or not you are verified:

Adding computers one installer at a time has no limit. Mass deploy is for established organisations that have verified their account (in the dashboard, under Settings > Verification), so verify yours first — an unverified account is not switched on, whatever it manages. Once it is verified and managing more than ten computers, we look at it and switch mass deploy on; you can ask at support@moorfox.com, saying how many machines you are bringing over and from where.

Reinstalling or removing the agent

To repair an agent on a machine you already have, use Actions then Reinstall on the device's own page rather than enrolling it again. That replaces the binary while keeping the device's identity, so its history, inventory and score stay on the same page. Running a fresh Easy installer on the machine does the same: an enrolled machine keeps its identity and the code in the file goes unused.

To remove the agent entirely, run the uninstall form of the installer on the machine:

iwr https://app.moorfox.com/install.ps1 -UseBasicParsing | iex; Uninstall-Moorfox

curl -fsSL https://app.moorfox.com/install.sh | sudo sh -s -- --uninstall

Troubleshooting

Next: connect to the machine and use the RMM tools, or sort it into a group and tag it.