ConnectWise RMM

Deploy the sensor to Windows endpoints using connectwise-rmm-acium.ps1, a ready-made script maintained in the rmm-scripts repository. It's designed to run as a recurring ConnectWise RMM script, safely skipping machines that are already up to date.

Note

Status: untested. This script hasn't yet been run against a live ConnectWise RMM deployment. Validate it end-to-end in a lab/pilot environment before rolling it out to production endpoints.

Note

This targets ConnectWise RMM — the Asio-based SaaS product ConnectWise currently markets under that name — not ConnectWise Automate (formerly LabTech), which has its own separate scripting engine. If you're on Automate, adapt this script rather than assuming it drops in unchanged.

Configuration mechanism is unverified

Datto RMM and NinjaOne both expose a documented per-script variable system that injects named values into a script's process as environment variables at runtime. Public ConnectWise RMM documentation didn't confirm whether an equivalent exists for a plain "PowerShell Script" step — ConnectWise RMM does have variable concepts (predefined variables mapped to custom fields, user-defined variables, %output%), referenced with %VariableName% syntax, but it's unclear whether that's genuine environment-variable injection or a text-substitution mechanism scoped to ConnectWise's own script-editor blocks.

Rather than guess, this script hardcodes its configuration (same pattern as the Generic script) so it works correctly regardless of how your tenant's variable system behaves. If your instance does support wiring a custom field into a script as a true $env: variable, you can switch the script's SECTION 1 to read from $env: the way dattormm-acium.ps1/ninjaone-acium.ps1 do — confirm the exact variable name/casing first, and record the change in the repo's CHANGELOG.md.

How ConnectWise RMM's script/task history UI surfaces this script's exit code is also unverified — deploy.log on the endpoint carries full diagnostic detail regardless of what the console shows.

What the script does

On each run, in order:

1. Takes a machine-wide lock so an overlapping run can't run twice at once.
2. Checks whether anything's changed — compares the sensor package's ETag against the last successful run, and checks whether the AciumSensor Windows service is present. If both say "nothing to do," it exits.
3. Downloads the sensor .zip and hashes it (SHA256) as a second, server-independent change check.
4. Checks for the ASP.NET Core 8.0 Runtime and silently installs it if missing. If that install needs a reboot, the script defers the sensor install to the next scheduled run.
5. Extracts the .zip, locates AciumSensorInstall.msi, and checks its Authenticode signature.
6. Installs the MSI silently via msiexec, correctly distinguishing a first-time install from a reinstall, and verifies afterward that the sensor is actually present.
7. Cleans up downloaded files and records the new ETag/SHA256 — only after a verified successful install.

Configuration

All configuration is hardcoded in SECTION 1, between the EDIT THESE VALUES markers:

$DownloadUrl = 'https://storage.googleapis.com/ebm-sensors-prod/win/acium-sensor-setup-0.16.8.zip'
$Organization = ''
$ExpectedPublisherCN = ''

• $DownloadUrl — the direct URL of the pinned agent .zip. Required.
• $Organization — the org/tenant ID this sensor should report under, passed to the MSI as the ORGANIZATION property. Optional. If you maintain a separate copy of this script per client/site in ConnectWise RMM, this is typically the one line that differs between copies.
• $ExpectedPublisherCN — expected Authenticode signer subject CN. Optional, but recommended once you've confirmed the real signer from a first run's log.

Bumping to a new sensor version means editing $DownloadUrl and redeploying the script — there is no external variable to update instead.

Prerequisites

• ConnectWise RMM agent installed and checking in on target endpoints.
• Endpoints running Windows with PowerShell 5.1 (Windows PowerShell) or later.
• Outbound HTTPS access from endpoints to your sensor package's download URL and to aka.ms (for the ASP.NET Core Runtime installer, only needed on machines that don't already have it).

Setup in ConnectWise RMM

1. In the ConnectWise RMM script editor, create a new script and add a PowerShell script step.
2. Copy the contents of connectwise-rmm-acium.ps1 into the PowerShell step's body. Edit $DownloadUrl (and optionally $Organization/$ExpectedPublisherCN) directly in the pasted script before saving, per Configuration above.
3. Confirm execution context: ConnectWise RMM scripts typically execute as SYSTEM by default, but confirm this for your script/task type before deploying broadly — deploy.log's Running as: line on a test machine is the definitive check (should read NT AUTHORITY\SYSTEM).
4. Schedule the script to run recurring against your target device group (ConnectWise RMM supports hourly, daily, and weekly recurrence). Daily is sufficient for a "keep the sensor current" job — avoid scheduling more frequently than needed purely to reduce agent/API load.

Logs

File	What's in it
C:\ProgramData\AciumSensor\Logs\deploy.log	The script's step-by-step log — what it checked, downloaded, and decided.
C:\ProgramData\AciumSensor\Logs\msi-install.log	Windows Installer's verbose log for the MSI install.
C:\ProgramData\AciumSensor\Install\last-installed.json	State file recording the ETag and SHA256 of the last successfully installed package.

Exit codes

Code	Meaning
0	Success — installed, already up to date (no-op), or deferred pending a reboot
1	Download failed (sensor package or ASP.NET Core Runtime installer)
2	Could not secure the working/log directory (ACL hardening failed) — refused to proceed with a privileged install
3	Install failed (sensor MSI or ASP.NET Core Runtime installer)
4	Missing or invalid configuration value ($DownloadUrl empty, or $Organization contains a double quote)
5	Zip extraction failed / AciumSensorInstall.msi not found inside the package
6	MSI failed Authenticode signature verification against $ExpectedPublisherCN

Verify

Confirm on the device itself — see Step 4: Verify the extension was deployed.

Note

For full troubleshooting guidance (including known msiexec error 1638 and ACL-hardening failure cases) see the connectwise-rmm/ readme in the rmm-scripts repo — that's the source of truth for this script.