Deploy the Windows agent — PatchPilot Docs

Get an enrolment token

Recommended: use the Deploy Agent wizard in the admin console (sidebar → Deploy Agent). It mints a scoped ppen_ enrolment token and gives you ready-to-copy install commands for each OS. Enrolment tokens can only register new devices — they can't read or write any other org data — and expire automatically (30 days by default).

An org API key (ppk_, from Settings > API Keys) also works in the ORGAPIKEY property for backward compatibility, but it grants the same full read/write/admin access as the user who created it and never expires. Prefer an enrolment token for anything pasted into an installer command line, script, or RMM tool.

Option A: MSI (recommended)

Download the latest MSI from /downloads/PatchPilot-Agent.msi, then install with msiexec:

msiexec /i PatchPilot-Agent.msi ORGAPIKEY=ppen_your_enrollment_token /qn

The /qn flag runs silent. Drop it for an interactive install when troubleshooting on a single machine.

Option B: PowerShell one-liner

For ad-hoc installs, the wizard provides a one-liner. Run it from an elevated PowerShell:

iwr https://patchpilot.co.uk/downloads/Install-PatchPilot-Agent.ps1 -UseBasicParsing | iex

The script will prompt for the token (or accept it via the -Token parameter).

Option C: Intune

Download the .intunewin package from /downloads/PatchPilot-Bootstrap-latest.intunewin. In Intune, create a Win32 app with these install / uninstall commands:

Install:   msiexec /i PatchPilot-Agent.msi ORGAPIKEY=ppen_xxx /qn
Uninstall: msiexec /x {guid-from-msi} /qn

Set the detection rule to HKLM\SOFTWARE\PatchPilot\Agent\Version existing.

If you're already on Intune and want PatchPilot to wrap rather than replace it, enable Settings > Management mode > Intune co-management and add the +£20/mo Intune integration. PatchPilot will read device state from Graph and write compliance signals back.

Option D: GPO / SCCM

The MSI is a standard Windows Installer package — deploy it like any other software via Group Policy software installation or SCCM application deployment. Use the same ORGAPIKEY property.

Verify enrolment

Wait ~60 seconds for first check-in.
Open Devices in the admin console.
The new device should show Online with a recent heartbeat.
First inventory pass (winget list, installed updates, Defender posture) completes within ~5 minutes.

What the agent installs

Windows service: PatchPilotAgent (LocalSystem, automatic start).
Per-user task launcher (VBS-launched to avoid conhost popup).
Working directory: C:\ProgramData\PatchPilot\.
Log files: C:\ProgramData\PatchPilot\logs\ — rotated daily.

Uninstall

msiexec /x {guid-from-msi} /qn

Or from Settings > Apps > Installed apps, uninstall PatchPilot Agent. The agent retires itself in the admin console on graceful uninstall.