Deploy many devices at once — MSI with access and deployment key

What it is for

If you look after many computers, you do not want to set them up one by one. With the MSI you install BrowserDesk including the service through your software distribution. If you also pass the name of your access and a deployment key, every device joins your access while it is installed — no click, no password, no access password.

What you need

• An access in the Cloud or on your own relay. Free has no deployment keys; there devices join with a one-time code (C2).
• Enough free places in the access.
• The MSI: on browserdesk.de the MSI button in the download area (address /dl/client/latest/msi). On your own relay the same address on your server.
• Software distribution that runs msiexec with administrator rights (GPO, Intune, PDQ or your own script).
• Own relay: the devices must know your relay's address before they join (see “Good to know”).

How to do it

1. Create a deployment key

1. In the console Tenants → double-click the access (Edit tenant) → tab Add devices → section Deployment key. In the console an access is called a tenant.
2. Fill in Valid (days) (1 to 30), Maximum devices and a Note, then Create key.
3. The key (starts with bdk_) and the ready-made commands under How to install are visible only now. Copy key or Copy commands.

2. Deploy

Windows, MSI — the command for your software distribution:

msiexec /i BrowserDesk.msi BDZUGANG=<access> BDSCHLUESSEL=<key> /qn

The MSI installs for all users, sets up the service and stores the join request. The service redeems it as soon as it runs.

Windows, single file by script — without the MSI:

1. Download the current EXE and set it up as a service (Install a client from the command line).
2. Join: BrowserDesk.exe --join <access> --key <key> — without a window.

Linux (deb or rpm):

sudo BDZUGANG=<access> BDSCHLUESSEL=<key> apt install ./<file name>.deb

If the package manager does not pass the values on, put the file /var/lib/browserdesk/join-request.json with the content {"tenant":"<access>","key":"<key>"} there by hand.

3. After the rollout

Revoke the key in the console (row menu → Revoke). Devices already added stay.

How you know it worked

• In the console the key's row counts along: used / maximum, state “valid”, later “used up”.
• The devices appear under Devices in the access.
• On the device the card Zugang (Access) says: „Dieses Gerät gehört zum Zugang „…“ (bei der Installation oder von einem anderen Benutzer hinzugefügt).“ (this device belongs to access … — added at installation or by another user).
• --join returns an exit code: 0 added, 1 refused (the reason is in the output), 2 not yet (relay not reachable or access full — the service keeps trying), 64 wrong call.

Good to know

• Treat the key like a password. Anyone who can read the command line in your software distribution sees it. That is why it is time-limited, limited to a number of devices and revocable — and never the access password.
• Access full: a device with a key waits and asks again every 10 minutes. A place that becomes free or is bought is used without you doing anything.
• Own relay: the join goes to the relay the device knows — browserdesk.de by default. It is refused there („Dieser Verteil-Schlüssel gilt nicht für diesen Zugang.“ — this deployment key is not valid for this access), and the request is discarded. There is no MSI property for the relay address. Where the device stores the address is described in Change the relay address; there is no tested way yet to preset it during deployment — write to info@browserdesk.de.
• Mac: the MSI and --join exist only for Windows, the Linux package only for Linux. Add Macs one by one (C2).
• Without access without confirmation, someone at the device has to accept every session. How to reach devices unattended: C4.
• Redeeming the same request twice does no harm: a device counts once per key and keeps its place.

If it does not work