Deploy a small-footprint Windows agent built for MSP fleet scale, offline resilience, and tenant-bound runtime without inbound endpoint ports. Polling credentials, catalog APIs, and signed installers support regulated clients at 100k+ agent scale.
Visual summary before deep technical copy below.
Feature depth
Deploy a small-footprint Windows agent built for MSP fleet scale, offline resilience, and tenant-bound runtime without inbound endpoint ports. Polling credentials, catalog APIs, and signed installers support regulated clients at 100k+ agent scale.
The Trustholm agent targets ~15MB single-file deployment with Windows Service (SYSTEM) plus tray for user-context operations. Named pipe IPC avoids inbound network listeners on endpoints-a common hardening preference for regulated clients.
Credentials: Server issues polling key hash at register/heartbeat; agent persists in agent.runtime.json next to the executable. X-Agent-Key header required when enforcement is on. Runtime does not restore across tenant installs after --force imaging.
Fleet scale: Web UI uses lookup and catalog APIs with pagination-not full-fleet dropdowns. Designed for 100k+ agents per tenant with debounced search and scoped filters.
Resilience: Local outbox buffers ingest when API is unavailable. Heartbeat honors Retry-After on rate limits with jitter. Transient outages should not silently drop telemetry or queued work.
Installers: Tenant-scoped download URLs embed tenant code and API ring configuration. Packages are signed from platform distribution controls.
Push and pull files: Push remediation files or installers to one agent or a catalog-selected fleet slice. Pull logs and configs from endpoints into tenant artifact storage without RDP. Script pipelines in the PowerShell IDE chain push-before-run and pull-after-run into one governed execution.
Software (winget): Browse the full public winget catalog - not only apps shown in Intune's curated storefront. Add packages to a tenant-approved catalog, deploy via scheduled policies with maintenance windows, track inventory compliance, or use break-glass push when policy cadence is too slow. OS patching and Microsoft app policies can stay in Intune; winget governance lives in Trustholm when entitled.
Deployment at scale: Use catalog APIs for agent discovery-not CSV imports of entire fleets. Scope by customer and group before bulk operations. Rate limits apply; agents honor Retry-After with jitter during mass rollout events.
Service versus tray mode: SYSTEM service handles elevated operations; tray supports user-context scenarios. Document which scripts require which context in your internal library standards to avoid privilege misuse findings.
Imaging and reinstall: --force install clears cross-tenant runtime credential restore-verify tenant code in runtime JSON after golden image deployments. Common MSP pitfall after acquisitions merges wrong tenant into cloned machines.
Security reviews: Include agent polling credential rotation and installer signature verification in quarterly endpoint control tests. Distinct from portal MFA-both belong in questionnaire appendices.
Offline and air-gap: Outbox buffering helps transient outages; extended air-gap requires runbook clarity on queue behavior and signing verification edges. Do not assume silent sync without testing your worst-case outage duration.
Mass deploy in waves with rate-limit awareness; monitor Retry-After headers during golden-image pushes. Catalog APIs support customer and group scoping before bulk script assignment-never load entire 100k fleets into browser memory.
Tray versus service context decisions should be documented per script in your internal wiki to satisfy least-privilege assessor questions. After M&A integrations, run tenant runtime verification scripts before cutover weekend ends.
Sizing guidance: Pilot 50-200 agents before portfolio-wide push; measure API 429 rates and heartbeat latency; adjust rollout concurrency accordingly. Document findings in deployment standard operating procedure.
Endpoint conflict checks: Validate coexistence with incumbent RMM agents on representative hardware matrix before portfolio mandate-document CPU and memory impact in deployment guide.
Lifecycle ownership: Assign named owner for agent ring upgrades, polling credential rotation drills, and golden-image QA checklists-fleet scale failures are often process gaps not binary bugs.
Compliance packaging: Bundle agent footprint metrics, polling auth model, and runtime tenant binding screenshots into customer evidence ZIP alongside script export samples for holistic management-plane reviews. Include rate-limit observations from pilot rollout in deployment appendix for large fleets.
Golden-image regression suite: After Windows cumulative updates, re-run agent install, heartbeat, and script execution smoke tests on reference hardware before mass push. Document failures in deployment standard operating procedure with rollback steps.
Acquisition integration: When merging MSP tenants, validate agent runtime tenant codes on inherited endpoints before decommissioning legacy orchestration-misbound agents poll wrong tenant silently until heartbeat anomalies surface in operations review.
Fleet inventory reconciliation: Quarterly compare agent catalog row counts against incumbent RMM inventory for same customer scope. Discrepancies often indicate imaging gaps or decommissioned endpoints still polling-document reconciliation in endpoint management SOP.
Document tray-versus-service script catalog in technician certification checklist. Measure mean time to remediate cert expiry incidents and track as deployment maturity KPI.
Include agent ring upgrade communications in customer change advisory distribution lists for regulated clients. Benchmark agent CPU overhead against incumbent RMM during pilot and publish results in deployment standard to reduce engineering objections.
Add polling credential rotation drill to annual security awareness training for operations staff.
No inbound ports for command channel-agent polls outbound. Your network still controls egress to API endpoints. Document allowed egress URLs per deployment ring in customer firewall change requests.
Windows 10/11 and Server editions supported by the published agent ring. Verify against release notes for your deployment wave. Test tray versus service scripts on each target OS build annually.
Per-agent polling credentials plus tenant code headers. Distinct from portal SSO-document separately in access reviews. Rotate credentials after technician offboarding if exposure suspected.
Queued work and outbox patterns buffer when policy allows. Signing verification still applies; document air-gap behavior in your runbooks. Test longest expected outage duration quarterly.
Yes when Agent Management and winget entitlements are enabled. Browse public winget metadata, add packages to a tenant catalog, assign deployment policies with schedules and inventory compliance, or push to a single agent for break-glass installs. This complements Intune app deployment - especially for packages absent from Intune storefront curation.