Overview
Device registered
Run this on in an elevated PowerShell:
is registered. Nothing is installed on it.
One command, nothing to copy across. It installs the collector, stores the key encrypted, registers a scheduled task as SYSTEM, and reports back.
The command starts by switching PowerShell to TLS 1.2. That is required, not defensive: this server refuses TLS 1.0 and 1.1, and Server 2012 R2, 2016 and many Windows 10 builds still default to 1.0 — so without it the download itself fails with “Could not create SSL/TLS secure channel” before any of our code runs.
Needs PowerShell 3.0 or later. PowerShell 2.0 (Windows 7, Server 2008 R2, Windows Embedded) runs on the .NET 2.0 runtime and cannot do TLS 1.2 at all, whatever .NET version is installed. Those machines need remote collection from another server on the same network — not an upgrade.
Register a named device
Use this when you know the machine name. The API key is generated only when the link is redeemed, so no usable key ever sits in this page.
Reusable enrolment key
For when you do not know the machine name in advance. One short URL, usable on any number of machines — each names itself from its own hostname, and you set the client afterwards.
Run this on any machine, elevated for full coverage: