Generic RMM deployment

If your RMM platform doesn't have a dedicated script yet (see Deployment with an RMM for the ones that do), use generic-acium.ps1 from the rmm-scripts repository. It does the same install as the platform-specific scripts, but with all configuration hardcoded directly in the script instead of read from a platform's variable system — so it drops into any RMM, a scheduled task, or manual execution with no platform-specific setup.

What the script does

On each run, in order:

1. Takes a machine-wide lock so an overlapping run can't run twice at once.
2. Checks whether anything's changed — compares the sensor package's ETag against the last successful run, and checks whether the AciumSensor Windows service is present. If both say "nothing to do," it exits.
3. Downloads the sensor .zip and hashes it (SHA256) as a second, server-independent change check.
4. Checks for the ASP.NET Core 8.0 Runtime and silently installs it if missing. If that install needs a reboot, the script defers the sensor install to the next scheduled run.
5. Extracts the .zip, locates AciumSensorInstall.msi, and checks its Authenticode signature.
6. Installs the MSI silently via msiexec, correctly distinguishing a first-time install from a reinstall, and verifies afterward that the sensor is actually present.
7. Cleans up downloaded files and records the new ETag/SHA256 — only after a verified successful install.

A machine that's already current does almost nothing on a re-run — just a quick network check, then exit.

Configuration

There's no variable to set through an RMM — edit the values directly in generic-acium.ps1, between the EDIT THESE VALUES TO CONFIGURE A DEPLOYMENT markers near the top of SECTION 1: CONFIG:

$DownloadUrl = 'https://storage.googleapis.com/ebm-sensors-prod/win/acium-sensor-setup-0.16.8.zip'
$Organization = ''

• $DownloadUrl — required. The direct URL of the pinned sensor .zip. Bumping to a new version means editing this line and redeploying the script.
• $Organization — optional. Your organization/tenant ID, passed to the MSI as the ORGANIZATION property so the installed sensor reports under the right org. Leave blank to skip setting it. (An $Organization containing a double quote is invalid — see exit code 4 below.)

Prerequisites

• Windows endpoints with PowerShell 5.1 or later.
• The script must run with local Administrator / SYSTEM privileges (it installs software and writes to C:\ProgramData).
• Outbound HTTPS access to your sensor package's download URL and to aka.ms (for the ASP.NET Core Runtime installer, only needed on machines that don't already have it).

Deploying it

With no RMM-specific variable requirement, deployment is just: run the script as SYSTEM/Administrator on the target machine, on a recurring basis.

• Any RMM tool — paste the script body into a script/component of that platform, set it to run as System/Administrator, and schedule it recurring (e.g. daily).
• Windows Scheduled Task — create a task that runs powershell.exe -ExecutionPolicy Bypass -File generic-acium.ps1 as SYSTEM, on your preferred recurring schedule.
• Manual / ad hoc — run it directly from an elevated PowerShell prompt.

Logs

File	What's in it
C:\ProgramData\AciumSensor\Logs\deploy.log	The script's step-by-step log — what it checked, downloaded, and decided.
C:\ProgramData\AciumSensor\Logs\msi-install.log	Windows Installer's verbose log for the MSI install.
C:\ProgramData\AciumSensor\Install\last-installed.json	State file recording the ETag and SHA256 of the last successfully installed package.

Exit codes

Code	Meaning
0	Success — installed, already up to date (no-op), or deferred pending a reboot (see the log for which)
1	Download failed (sensor package or ASP.NET Core Runtime installer)
2	Could not secure the working/log directory (ACL hardening failed) — refused to proceed with a privileged install
3	Install failed (sensor MSI or ASP.NET Core Runtime installer)
4	Missing or invalid configuration value ($DownloadUrl left empty, or $Organization contains a double quote)
5	Zip extracted, but AciumSensorInstall.msi wasn't found inside it
6	MSI failed Authenticode signature verification against $ExpectedPublisherCN

Verify

Whatever runs the script can read these exit codes to distinguish a network issue, a misconfigured script, or an actual install problem. Confirm on the device itself — see Step 4: Verify the extension was deployed.

Note

For full troubleshooting guidance (including known msiexec error 1638 and ACL-hardening failure cases) see the generic/ readme in the rmm-scripts repo — that's the source of truth for this script.