NinjaOne

Deploy the sensor to Windows endpoints using ninjaone-acium.ps1, a ready-made script maintained in the rmm-scripts repository. It's designed to run as a recurring NinjaOne Scheduled Script on a Policy, safely skipping machines that are already up to date.

Note

Status: untested. This script hasn't yet been run against a live NinjaOne deployment. Validate it end-to-end in a lab/pilot environment before rolling it out to production endpoints.

What the script does

On each run, in order:

1. Takes a machine-wide lock so an overlapping run can't run twice at once.
2. Checks whether anything's changed — compares the sensor package's ETag against the last successful run, and checks whether the AciumSensor Windows service is present. If both say "nothing to do," it exits.
3. Downloads the sensor .zip and hashes it (SHA256) as a second, server-independent change check.
4. Checks for the ASP.NET Core 8.0 Runtime and silently installs it if missing. If that install needs a reboot, the script defers the sensor install to the next scheduled run.
5. Extracts the .zip, locates AciumSensorInstall.msi, and checks its Authenticode signature.
6. Installs the MSI silently via msiexec, correctly distinguishing a first-time install from a reinstall, and verifies afterward that the sensor is actually present.
7. Cleans up downloaded files and records the new ETag/SHA256 — only after a verified successful install.

Prerequisites

• NinjaOne agent installed and checking in on target endpoints.
• Endpoints running Windows with PowerShell 5.1 (Windows PowerShell) or later.
• Outbound HTTPS access from endpoints to your sensor package's download URL and to aka.ms (for the ASP.NET Core Runtime installer, only needed on machines that don't already have it).

Setup in NinjaOne

1. Add the script to your Script Library

Go to Administration > Library > Automation (Script Library), add a new script, and set its language to PowerShell.

2. Paste in the script

Copy the contents of ninjaone-acium.ps1 into the script body.

3. Add the Script Variables

This script reads its configuration from Script Variables, which NinjaOne injects into the script's process as environment variables for the lifetime of the run (ctrl+space in the script editor to insert one):

Variable name	Type	Required	Example value
AgentDownloadUrl	String	Yes	https://storage.googleapis.com/ebm-sensors-prod/win/acium-sensor-setup-0.16.8.zip
AgentOrganization	String	No	Your org/tenant ID, passed to the MSI as the ORGANIZATION property
ExpectedPublisherCN	String	No	Expected Authenticode signer subject CN, e.g. Acium, Inc. — when set, an MSI not validly signed by it is refused

You can override AgentOrganization per policy or per scheduled-script assignment if different customers/sites need different org IDs. Bumping to a new sensor version later is just updating AgentDownloadUrl — you don't need to edit the script itself.

4. Set execution context

When scheduling the script (or running it ad hoc), set Run As to System, not the logged-on user. Running as anything other than System can surface UAC prompts that a background service context never would.

5. Deploy as a Scheduled Script

Assign the script to a Policy's Scheduled Scripts, running on a recurring schedule (e.g. daily) against your target device group. Because the script checks for changes before doing any real work, recurring execution is cheap — most runs will be a quick no-op.

Logs

File	What's in it
C:\ProgramData\AciumSensor\Logs\deploy.log	The script's step-by-step log — what it checked, downloaded, and decided.
C:\ProgramData\AciumSensor\Logs\msi-install.log	Windows Installer's verbose log for the MSI install.
C:\ProgramData\AciumSensor\Install\last-installed.json	State file recording the ETag and SHA256 of the last successfully installed package.

Exit codes

Code	Meaning
0	Success — installed, already up to date (no-op), or deferred pending a reboot
1	Download failed (sensor package or ASP.NET Core Runtime installer)
2	Could not secure the working/log directory (ACL hardening failed) — refused to proceed with a privileged install
3	Install failed (sensor MSI or ASP.NET Core Runtime installer)
4	Missing or invalid Script Variable (AgentDownloadUrl empty, or AgentOrganization contains a double quote)
5	Zip extraction failed / AciumSensorInstall.msi not found inside the package
6	MSI failed Authenticode signature verification against ExpectedPublisherCN

NinjaOne surfaces the script's exit code on the activity/result view.

Verify

Confirm on the device itself — see Step 4: Verify the extension was deployed.

Note

For full troubleshooting guidance (including known msiexec error 1638 and ACL-hardening failure cases) see the ninjaone/ readme in the rmm-scripts repo — that's the source of truth for this script.