In this article

Follow this article to silent install the Windows Roaming Client through a command-line script or trigger using an Remote Monitoring and Management (RMM) tool. See the macOS deployment guide for silent install steps.

Installing the Roaming Client via silent install is useful for environments with repeated installations, multiple computers to deploy at once, or to keep end users out of the installation process.   

Windows Roaming Client 3.0 and higher require .NET 8. Confirm the .NET 8 Runtime is present if the installer reports a missing dependency. Future builds may remove this requirement as NativeAoT becomes available.

Windows agent silent install

Deploy the Windows Roaming Client via a command prompt to complete a silent install. 

1. Follow the Roaming Client deployment guide for details to setup a Site, copy the Site Secret Key, and download the installer
2. Install the Roaming Client with all default options
3. Open an Administrative Prompt
4. Add the Site Secret Key and run the following command.

If you are unsure which installer applies to your account, confirm the filename shown in your dashboard by navigating to Deployments, selecting Roaming Clients, and selecting Install Roaming Client.

• msiexec /qn /i "C:\path\to\DNSFilter-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• msiexec /qn /i "C:\path\to\DNSFilter-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

• msiexec /qn /i "C:\path\to\DNS-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• msiexec /qn /i "C:\path\to\DNS-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

Additional Command-line options

Customize the silent install with these additional command-line options. 

Windows agent RMM install

If using an RMM or other tool to install the Roaming Client, use this PowerShell script to download and install the Roaming Client without the need to distribute the MSI file to the computers.

Follow the Roaming Client deployment guide for steps to create a Site and copy the Site Secret Key for this script.

Replace 3.6.10 in the URL and filename with the current Roaming Client version. The current version is available in the dashboard by navigating to Deployments, selecting Roaming Clients, and selecting Install Roaming Client.

If you are unsure which installer applies to your account, confirm the filename shown in your dashboard by navigating to Deployments, selecting Roaming Clients, and selecting Install Roaming Client.

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-x64.msi"
  msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-arm64.msi"
  msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\temp\DNS-Agent-Setup-x64.msi"
  msiexec /qn /i "C:\temp\DNS-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\temp\DNS-Agent-Setup-arm64.msi"
  msiexec /qn /i "C:\temp\DNS-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

Commands by tool (MST Transform, Golden-Image, Datto RMM, ConnectWise Automate)

Here are other helpful scripts and instructions designed for specific tools. Deploy the Windows agent with Active Directory by following the linked steps. 

• Distribute the Windows agent MSI file with customizations as an Orca transform file. This is useful for mass deployments without using Active Directory Group Policy to perform the installation (for example, MSPs that use RMM software).

  Generate an MST file in Orca and then deploy with this command or RMM equivalent:

  msiexec /qn /i "C:\path\to\DNSFilter-Agent-Setup.msi" TRANSFORMS="C:\path\to\orcatransformed.mst"

• Installing the Roaming Client must be the last step of the image setup process if using a standardized image to deploy or reinstall computers.

  If the Roaming Client is installed with an active network connection and allowed to register with our API, the Roaming Client will not receive a unique ID on each computer that received the standardized image.

  Follow these steps to install the agent without registration.

  1. Download the Roaming Client Installer from the DNSFilter dashboard
  2. Disconnect all active network connections
  3. Install the Roaming Client
  4. Finalize Image

• Ensure Site Key variables called from Datto RMM pass correctly with the appropriate command.

  Replace 3.6.10 in the URL and filename with the current Roaming Client version. The current version is available in the dashboard by navigating to Deployments, selecting Roaming Clients, and selecting Install Roaming Client.

  • Standard Agent x64

    # Set variable for site key from Datto Variable
    $siteKey = $env:SITESECRETKEY
    # Create C:\temp
    mkdir C:\temp
    # Download installer to C:\temp
    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-x64-3.6.10.msi"
    # Install Roaming Client
    msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-x64-3.6.10.msi" NKEY="$siteKey"

  • Standard Agent ARM64

    # Set variable for site key from Datto Variable
    $siteKey = $env:SITESECRETKEY
    # Create C:\temp
    mkdir C:\temp
    # Download installer to C:\temp
    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-arm64-3.6.10.msi"
    # Install Roaming Client
    msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-arm64-3.6.10.msi" NKEY="$siteKey"

  • Legacy Whitelabel Agent x64

    # Set variable for site key from Datto Variable
    $siteKey = $env:SITESECRETKEY
    # Create C:\temp
    mkdir C:\temp
    # Download installer to C:\temp
    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\temp\DNS-Agent-Setup-x64-3.6.10.msi"
    # Install Roaming Client
    msiexec /qn /i "C:\temp\DNS-Agent-Setup-x64-3.6.10.msi" NKEY="$siteKey"

  • Legacy Whitelabel Agent ARM64

    # Set variable for site key from Datto Variable
    $siteKey = $env:SITESECRETKEY
    # Create C:\temp
    mkdir C:\temp
    # Download installer to C:\temp
    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\temp\DNS-Agent-Setup-arm64-3.6.10.msi"
    # Install Roaming Client
    msiexec /qn /i "C:\temp\DNS-Agent-Setup-arm64-3.6.10.msi" NKEY="$siteKey"

• Install the Windows Roaming Client with ConnectWise Automate. For issues with ConnectWise Automate, contact ConnectWise Support.

  The commands save the installer in the ConnectWise LTSvc folder, so no new folder is needed. Replace 3.6.10 in the URL and filename with the current Roaming Client version. The current version is available in the dashboard by navigating to Deployments, selecting Roaming Clients, and selecting Install Roaming Client.

  Run the download command, then the install command with the Site Secret Key in place of SITESECRETKEY. After the installation finishes (about 10 to 15 minutes), the Roaming Client appears in the ConnectWise portal.

  • Standard Agent x64

    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\Windows\LTSvc\DNSFilter-Agent-Setup-x64.msi"
    msiexec /qn /i "C:\Windows\LTSvc\DNSFilter-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

  • Standard Agent ARM64

    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\Windows\LTSvc\DNSFilter-Agent-Setup-arm64.msi"
    msiexec /qn /i "C:\Windows\LTSvc\DNSFilter-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

  • Legacy Whitelabel Agent x64

    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-x64-3.6.10.msi" -OutFile "C:\Windows\LTSvc\DNS-Agent-Setup-x64.msi"
    msiexec /qn /i "C:\Windows\LTSvc\DNS-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

  • Legacy Whitelabel Agent ARM64

    Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-arm64-3.6.10.msi" -OutFile "C:\Windows\LTSvc\DNS-Agent-Setup-arm64.msi"
    msiexec /qn /i "C:\Windows\LTSvc\DNS-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

  Remove the Roaming Client devices from TCP - Port 53 monitoring groups to avoid false alarms when ConnectWise checks the port.

  To pull the current Stable release without updating the version in the URL, use the links in Unversioned installers.

Unversioned installers

Unversioned installer links always point to the current Stable release. After a release is promoted to Stable, allow up to 24 hours for the unversioned file to reflect the new build. Use versioned links when a deployment must pin to a specific build.

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-x64.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-x64.msi"
  msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNSFilter-Agent-Setup-arm64.msi" -OutFile "C:\temp\DNSFilter-Agent-Setup-arm64.msi"
  msiexec /qn /i "C:\temp\DNSFilter-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-x64.msi" -OutFile "C:\temp\DNS-Agent-Setup-x64.msi"
  msiexec /qn /i "C:\temp\DNS-Agent-Setup-x64.msi" NKEY="SITESECRETKEY"

• mkdir C:\temp
  Invoke-WebRequest -Uri "https://downloads.dnsfilter.com/User_Agent/Windows/DNS-Agent-Setup-arm64.msi" -OutFile "C:\temp\DNS-Agent-Setup-arm64.msi"
  msiexec /qn /i "C:\temp\DNS-Agent-Setup-arm64.msi" NKEY="SITESECRETKEY"

Each unversioned installer has a matching checksum file. The checksum filename is the installer filename plus .sha256sum.asc (for example, DNSFilter-Agent-Setup-x64.msi.sha256sum.asc). A deployment script can download the checksum file, compare the hash to the one from its last run to detect whether a new build is available, and verify the installer after downloading.

The following PowerShell example checks the checksum file before downloading and installing, and skips the download if the build has not changed since the last run:

$base = 'https://downloads.dnsfilter.com/User_Agent/Windows'
$msi  = 'DNSFilter-Agent-Setup-x64.msi'   # or DNS-Agent-Setup-x64.msi, or the -arm64 versions
$dir  = 'C:\Temp'
New-Item -ItemType Directory -Force -Path $dir | Out-Null
# 1. Get the published hash (small file)
Invoke-WebRequest "$base/$msi.sha256sum.asc" -OutFile "$dir\$msi.sha256sum.asc" -UseBasicParsing
$expected = ((Select-String -Path "$dir\$msi.sha256sum.asc" -SimpleMatch $msi).Line -split '\s+')[0]
# 2. Download only if the hash changed since the last run
$last = Get-Content "$dir\$msi.last" -ErrorAction SilentlyContinue
if ($expected -ne $last) {
   Invoke-WebRequest "$base/$msi" -OutFile "$dir\$msi" -UseBasicParsing
   # 3. Verify before installing
   $actual = (Get-FileHash "$dir\$msi" -Algorithm SHA256).Hash
   if ($actual -ieq $expected) {
       Set-Content "$dir\$msi.last" $expected
       msiexec /qn /i "$dir\$msi" NKEY="<SITE_SECRET_KEY>"
   } else {
       Remove-Item "$dir\$msi"
       throw 'Checksum mismatch. Installer deleted.'
   }
}

Third-party deployment support

Recommendations

We recommend testing any third-party solutions before use. For additional support, consult vendor documentation or search and post in our Community for content specific to your tool.

• Active Directory
• Intune