N-Able

Deploy the sensor to Windows endpoints using n-able-acium.ps1, a ready-made script maintained in the rmm-scripts repository. It's designed to run as a recurring N-central Automation Manager Policy, safely skipping machines that are already up to date.

Note

Status: untested. This script hasn't yet been run against a live N-able deployment. Validate it end-to-end in a lab/pilot environment before rolling it out to production endpoints.

Note

Targets N-central (Automation Manager), not N-sight RMM. N-able sells two separate RMM products under one brand. This script targets N-central because its Automation Manager has a dedicated "Run PowerShell Script" Object with documented Input/Output Parameters built specifically for PowerShell. N-sight RMM's custom-script docs describe passing arguments via a "Command Line" field, with examples only in batch/bash/VBScript — if you're on N-sight RMM, read the parameter-mechanism warning below carefully before deploying.

Parameter mechanism — unverified, test before relying on it

N-able's documentation confirms that Automation Manager's "Run PowerShell Script" Object requires Input Parameters to be preceded by $ for the script engine to recognize them, but doesn't show a concrete example of the underlying mechanism (environment variable vs. the Object binding directly to a same-named PowerShell parameter vs. literal text substitution). This script uses a standard PowerShell param() block at the top of the file and expects Input Parameters named to match it.

Before deploying this to more than a single test device: run the Object once against a test machine with each Input Parameter set to an obviously-distinct value, then check deploy.log's Download URL: / Organization: lines to confirm the values actually arrived. If your N-central instance instead injects values as environment variables (the way Datto RMM and NinjaOne do), change the top of n-able-acium.ps1 to read $env:AgentDownloadUrl etc. instead of the param() block.

Similarly, SYSTEM execution context is unverified: the docs mention a "Run as Current Logged on User" option on the Object, implying unchecked runs under the N-central agent's own service account, but don't explicitly confirm that account is NT AUTHORITY\SYSTEM on every N-central configuration. Confirm via deploy.log's Running as: line after your first test run.

What the script does

On each run, in order:

1. Takes a machine-wide lock so an overlapping run can't run twice at once.
2. Checks whether anything's changed — compares the sensor package's ETag against the last successful run, and checks whether the AciumSensor Windows service is present. If both say "nothing to do," it exits.
3. Downloads the sensor .zip and hashes it (SHA256) as a second, server-independent change check.
4. Checks for the ASP.NET Core 8.0 Runtime and silently installs it if missing. If that install needs a reboot, the script defers the sensor install to the next scheduled run.
5. Extracts the .zip, locates AciumSensorInstall.msi, and checks its Authenticode signature.
6. Installs the MSI silently via msiexec, correctly distinguishing a first-time install from a reinstall, and verifies afterward that the sensor is actually present.
7. Cleans up downloaded files and records the new ETag/SHA256 — only after a verified successful install.

Prerequisites

• N-central probe/agent installed and checking in on target endpoints.
• Endpoints running Windows with PowerShell 5.1 (Windows PowerShell) or later.
• Outbound HTTPS access from endpoints to your sensor package's download URL and to aka.ms (for the ASP.NET Core Runtime installer, only needed on machines that don't already have it).
• An N-central license/edition that includes Automation Manager.

Setup in N-central

1. Go to Configuration > Automation Manager and create a new Policy (or edit an existing one) targeting your device group/filter.

2. Add a Run PowerShell Script Object to the Policy, and paste the contents of n-able-acium.ps1 into it.

3. Define these as Input Parameters on the Object (names must be alphabetic only — no numbers, spaces, or symbols):

   Input Parameter name	Type	Required	Example value
   AgentDownloadUrl	Text	Yes	https://storage.googleapis.com/ebm-sensors-prod/win/acium-sensor-setup-0.16.8.zip
   AgentOrganization	Text	No	Your org/tenant ID, passed to the MSI as the ORGANIZATION property
   ExpectedPublisherCN	Text	No	Expected Authenticode signer subject CN, e.g. Acium, Inc.

   See the parameter-mechanism warning above — verify these values actually reach the script before trusting this in production.

4. Confirm the Object is not set to "Run as Current Logged on User" — leave that off so it runs under the N-central agent's own service account, and verify that resolves to SYSTEM via deploy.log's Running as: line.

5. Assign the Policy to run on a recurring schedule (e.g. daily) against your target device group.

Logs

File	What's in it
C:\ProgramData\AciumSensor\Logs\deploy.log	The script's step-by-step log — what it checked, downloaded, and decided.
C:\ProgramData\AciumSensor\Logs\msi-install.log	Windows Installer's verbose log for the MSI install.
C:\ProgramData\AciumSensor\Install\last-installed.json	State file recording the ETag and SHA256 of the last successfully installed package.

Exit codes

Code	Meaning
0	Success — installed, already up to date (no-op), or deferred pending a reboot
1	Download failed (sensor package or ASP.NET Core Runtime installer)
2	Could not secure the working/log directory (ACL hardening failed) — refused to proceed with a privileged install
3	Install failed (sensor MSI or ASP.NET Core Runtime installer)
4	Missing or invalid Input Parameter (AgentDownloadUrl empty, or AgentOrganization contains a double quote)
5	Zip extraction failed / AciumSensorInstall.msi not found inside the package
6	MSI failed Authenticode signature verification against ExpectedPublisherCN

Automation Manager only distinguishes success from failure in its own UI — read deploy.log for the specific code.

Verify

Confirm on the device itself — see Step 4: Verify the extension was deployed.

Note

For full troubleshooting guidance (including known msiexec error 1638 and ACL-hardening failure cases) see the n-able/ readme in the rmm-scripts repo — that's the source of truth for this script.