Prismara ReachHow-to guide

Deploy the Prismara Reach agent

Applies to Administrators
⏱ 15 min

Each device you want to monitor or connect to needs the Prismara Reach agent. When you install the agent with your organisation’s enrolment token, the device appears in the Reach console automatically.

Before you begin

You need the Reach administrator role in Prismara.
You need local administrator (Windows), administrator (macOS) or sudo (Linux) rights on each device, or a device management tool that installs software with those rights.
Tell your security team before a wide rollout. If your endpoint protection needs to allow the agent, they can add it before you start.

Get the installer and enrolment token

Sign in to the Reach console at https://reach.prismara.eu.
Select Devices > Add devices.
Choose the Site or customer the devices belong to. Devices enrolled with this token are placed in that site.
Select Copy next to Enrolment token, and download the installer for each platform you need.

Screenshot pendingAdd devices panel showing site selector, masked enrolment token with Copy button, and Windows, macOS and Linux download buttons

Install the agent

Interactive install

Run PrismaraReachAgent.msi as an administrator.
When prompted, paste the enrolment token and select Install.
Select Finish.

Silent install with your device management tool

Deploy PrismaraReachAgent.msi as a line-of-business or MSI application in your device management tool, such as Microsoft Intune or Configuration Manager, with this command line:

msiexec /i PrismaraReachAgent.msi /qn ENROLMENTTOKEN="<your-enrolment-token>"

Assign the app to a device group, not a user group, so that it installs whether or not anyone is signed in.

Open PrismaraReachAgent.pkg and follow the installer. Enter the enrolment token when prompted.
When macOS shows System Extension Blocked, open System Settings > Privacy & Security and select Allow next to the Prismara Reach message.
In System Settings > Privacy & Security, turn on Prismara Reach under Accessibility and Screen & System Audio Recording. Without these, technicians can view the screen but not control it, or see a black screen.

Screenshot pendingmacOS Privacy and Security settings with Prismara Reach turned on under Screen and System Audio Recording

On Macs managed by a device management tool, you can deploy the .pkg and pre-approve the system extension and privacy permissions with a configuration profile, so users aren’t prompted. Screen recording permission can’t be granted silently on all macOS versions; users may still need to approve it once.

Copy the package for your distribution to the device.

Install it, passing the enrolment token:

# Debian or Ubuntu
sudo PRISMARA_ENROLMENT_TOKEN="<your-enrolment-token>" apt install ./prismara-reach-agent_amd64.deb

# Fedora or RHEL
sudo PRISMARA_ENROLMENT_TOKEN="<your-enrolment-token>" dnf install ./prismara-reach-agent.x86_64.rpm

Check that the agent is running:
Terminal window
```
systemctl status prismara-reach-agent
```

Remote desktop on Linux works best on X11 sessions. On Wayland desktops, the user may need to approve screen sharing each time a session starts.

Verify

In the Reach console, select Devices.
Check that the new device appears in the correct site with the status Online. This can take a few minutes after installation.

Screenshot pendingDevices list showing three demo devices (CONTOSO-LT01, CONTOSO-SRV01, fabrikam-ws02) all Online