This permanently removes the pharmacy and all its data from the Fleet API. The Supervisor on the store VM will receive 410 Gone on its next heartbeat and switch to announce mode — run the script below on the VM to fully uninstall it.
Run in elevated PowerShell on the store VM (stops the service, removes the MSI, and clears all agent state):
Or uninstall locally without the script: Settings → Apps (or Control Panel → Programs) → Fleet Agent → Uninstall.
Run in an elevated PowerShell on the store VM (or push via RMM — it runs as SYSTEM and works as-is) — within ~60s the machine appears under Pending Approval. No token needed. If the store's firewall SSL-inspects HTTPS, use Tolerate from the start.
Enrols as Tolerate. Once connected, flip a machine's mode from its card — but a Trusted install already stuck on an inspecting store can't be switched by re-running this; it needs a full uninstall + reboot first. So pick the right mode up front.
Download 403 / blocked? A content-filtering proxy may block the headless download even with the browser User-Agent. Download FleetAgent.msi in a browser (click Keep past the SmartScreen "unrecognised app" flag — it's the signed MSI, TWCM PTY LTD), then install by absolute path (SYSTEM/RMM don't share your Downloads folder): msiexec /i C:\Users\<user>\Downloads\FleetAgent.msi /qn (add REQUIRETRUSTEDTLS=false for Tolerate).
Tried Tolerate and still nothing? It isn't inspection — check outbound 443, clock, and internet, and the Supervisor log at C:\ProgramData\FleetAgent\Supervisor\logs\.
Optional — ask IT / MSP to trust the firewall's CA (only posx-harness needs trusted TLS):
Controls whether this VM (and its agents) validate the server certificate. Integrity is always protected by signed instructions, updates, and the signed installer — this only changes whether the certificate must be trusted.
One MSI installs a small Windows service (FleetAgentLauncher, LocalSystem) that runs and auto-updates the Supervisor. Install once — everything after that updates itself.
Firewall: all it needs is outbound HTTPS (443) to the fleet/blob hosts. Two things a store firewall can do: (1) SSL-inspect — re-sign HTTPS with its own CA; enrolment defaults to Trusted and will reject that, so install in Tolerate from the start (see TLS mode below). (2) Content-filter — some proxies 403 non-browser downloads; the command sends a browser User-Agent to get past that, and if a proxy still blocks it, download the MSI in a browser and install by absolute path (see the Enrol dialog's "Still didn't appear?"). The IT / MSP request in the Enrol dialog is optional — needed only for posx-harness, or to stop the firewall reading agent traffic.
twc-{store number} (e.g. twc-341). For posx-harness this is also used as the site code automatically.One VM per Pharmacy ID. Each Pharmacy ID supports one enrolled machine. For pharmacies with multiple VMs, give each a unique ID — see Multi-VM pharmacies below.
Most pharmacies have a single VM — no special setup needed. If a store has two or more VMs (e.g. a POS terminal and a dedicated server), each VM needs its own Pharmacy ID and a role so you can control which agents each one runs.
twc-341) — it becomes the Pharmacy ID. For each additional VM, enter the same store code and select Add as new VM; Fleet auto-assigns a numeric suffix (twc-341-2, twc-341-3, …).PUT /pharmacies/twc-341/roles {"roles":["server"]}
PUT /pharmacies/twc-341-2/roles {"roles":["pos"]}
targetRoles on the agent to limit which VMs receive it:
POST /admin/agents/fleet-push
{ "agent": { "name": "posx-harness", "mode": "Deployment", "targetRoles": ["pos"] } }
Agents with no targetRoles (the default) are pushed to all VMs regardless of role — so existing single-VM pharmacies are unaffected.
Each machine connects in one of two postures, shown as a badge on the card — click it to change:
Installing: machines default to Trusted. If a store SSL-inspects, the Supervisor rejects the firewall's re-signed cert and never reaches Pending Approval — so install in Tolerate from the start (the Tolerate command in Enrol Machine, i.e. REQUIRETRUSTEDTLS=false). Once a machine is connected, you can flip its mode here anytime — the change reaches it in the signed manifest, no reinstall.
Fixing a Trusted install that's stuck (installed Trusted, never connected, so you can't flip it from the card): a plain reinstall won't switch it — the persisted mode wins. Fully uninstall (msiexec /x), reboot so Windows finishes removing the service, then reinstall with REQUIRETRUSTEDTLS=false. Better to avoid it by choosing Tolerate up front.
Until you set it explicitly, the badge mirrors the mode the Supervisor is actually using; once you choose, the dashboard is authoritative.
iex ((curl.exe -fsSL <fleet-url>/uninstall-agent.ps1) -join "`n"). Stops the service, removes the MSI, and clears all supervisor state. The Delete dialog on a pharmacy shows the exact command.Removing a single agent from a pharmacy's manifest just stops that agent on the VM — Fleet-installed agents are uninstalled; discovered (KeepAlive) agents are stopped but their own install files remain for the operator to clear.
API URLs and other installer settings can be stored once per environment in ⚙ Admin → Environment Profiles. When adding an agent to a pharmacy, pick the environment and settings fill in automatically — only the pharmacy-specific API key needs to be entered.
Brands are referenced by every pharmacy. Deleting a brand while pharmacies use it will fail — reassign them first.
| Order | Code | Name |
|---|
Set the API URL and other install settings once per environment. When you add an agent to a pharmacy, pick the environment and these fill in automatically.
| Agent | Environment | Params | Updated | |
|---|---|---|---|---|
| Loading… | ||||
Per-agent, per-channel artifact configuration. The supervisor picks the row matching the agent's channel, falling back to stable. Floating = no version set; supervisor always downloads the latest from the URL.
| Agent | Channel | Version | Updated | |
|---|---|---|---|---|
| Loading… | ||||
.sha256, else by hashing the artifact).Enter your email to receive a login link.
A login link has been sent. It expires in 10 minutes.