RMM Mass-Deploy

Push the agent across a fleet from your RMM using the silent command. Your RMM runs it in SYSTEM context.

First, download and verify the installer, and host it where your RMM can reach it (or upload it as a managed file in your RMM).

Silent command

EULA=ACCEPT is the first property after the install flags. Pick the property set for your deployment scope.

Single-org (internal IT):

SparkLogsAgentSetup-x64-1.6.0.exe /qn /norestart EULA=ACCEPT REGISTRATION_TOKEN=us_97... USEPARENTORG=1

Client-org (multi-tenant): map a per-client RMM variable onto RMMCLIENTID so each client's endpoints land in that client's organization:

SparkLogsAgentSetup-x64-1.6.0.exe /qn /norestart EULA=ACCEPT REGISTRATION_TOKEN=us_97... RMMCLIENTID=<RMM_CLIENT_ID> CLIENTNAME="<CLIENT_NAME>"

Use a distinct RMMCLIENTID per client; never one constant value across the fleet. CLIENTNAME can optionally specify the name of the client organization if one is auto-created (if not specified, the agent will use the AD domain name).

These commands accept the SparkLogs Agent license (EULA=ACCEPT).

Detection and confirmation

Use the Windows service for detection rules, not the MSI product code (the GUID changes across versions):

if (Get-Service "SparkLogsAgent" -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Confirm enrollment in the Agents list and verify data in Explore.