Syncro

Deploy the sensor to Windows endpoints using syncro-acium.ps1, a ready-made script maintained in the rmm-scripts repository. It's designed to run as a recurring Syncro script assigned to a Policy's Script Schedule, safely skipping machines that are already up to date.

Note

Status: untested. This script hasn't yet been run against a live Syncro deployment. Validate it end-to-end in a lab/pilot environment before rolling it out to production endpoints.

A note on how configuration reaches this script

Unlike Datto RMM/NinjaOne, which inject Component/Script Variables as environment variables ($env:Name), Syncro's documented example shows a script variable named runtime referenced directly as plain $runtime, not $env:runtime (see Syncro's Manage Scripts docs). That confirms the reference syntax — a bare top-level PowerShell variable matching the name given in Syncro's "Add Script Variable" UI — but Syncro doesn't publicly document the exact injection mechanism or its timing in more detail. syncro-acium.ps1 uses Agent-prefixed names (AgentDownloadUrl, not DownloadUrl) specifically so Syncro's injected variables can't collide with the script's own internal variables regardless of which mechanism it turns out to be. If your tenant's behavior differs, confirm against current Syncro docs and adjust SECTION 1 of the script.

What the script does

On each run, in order:

1. Takes a machine-wide lock so an overlapping run can't run twice at once.
2. Checks whether anything's changed — compares the sensor package's ETag against the last successful run, and checks whether the AciumSensor Windows service is present. If both say "nothing to do," it exits.
3. Downloads the sensor .zip and hashes it (SHA256) as a second, server-independent change check.
4. Checks for the ASP.NET Core 8.0 Runtime and silently installs it if missing. If that install needs a reboot, the script defers the sensor install to the next scheduled run.
5. Extracts the .zip, locates AciumSensorInstall.msi, and checks its Authenticode signature.
6. Installs the MSI silently via msiexec, correctly distinguishing a first-time install from a reinstall, and verifies afterward that the sensor is actually present.
7. Cleans up downloaded files and records the new ETag/SHA256 — only after a verified successful install.

Prerequisites

• Syncro agent installed and checking in on target endpoints.
• Endpoints running Windows with PowerShell 5.1 (Windows PowerShell) or later.
• Outbound HTTPS access from endpoints to your sensor package's download URL and to aka.ms (for the ASP.NET Core Runtime installer, only needed on machines that don't already have it).

Setup in Syncro

1. Add the script

Go to Scripts (or Automation > Scripts, naming varies by tenant/version) and create a new script. Set its type to PowerShell.

2. Paste in the script

Copy the contents of syncro-acium.ps1 into the script body.

3. Add the Script Variables

Click Add Script Variable (type String) for each of these:

Variable name	Required	Example value
AgentDownloadUrl	Yes	https://storage.googleapis.com/ebm-sensors-prod/win/acium-sensor-setup-0.16.8.zip
AgentOrganization	No	Your org/tenant ID, passed to the MSI as the ORGANIZATION property
ExpectedPublisherCN	No	Expected Authenticode signer subject CN, e.g. Acium, Inc. — when set, an MSI not validly signed by it is refused

Bumping to a new sensor version later is just updating AgentDownloadUrl — you don't need to edit the script itself. If different customers/sites need different AgentOrganization values, set that variable's value per script assignment/policy rather than maintaining separate copies of the script.

4. Set execution context

When configuring the script for scheduled or ad hoc execution, set Run As to System, not the logged-in user. Running as anything other than System can surface UAC prompts that a background service context never would.

5. Deploy as a Script Schedule

In a Policy, under the Policy Builder's Scripting category, add this script under Script Schedules with a recurring interval (Syncro supports intervals from every 15 minutes up to monthly; Syncro's own guidance recommends no more than daily for scheduled scripts). You can also run it once, ad hoc, against a specific asset from the Assets & RMM page to test it before scheduling.

Logs

File	What's in it
C:\ProgramData\AciumSensor\Logs\deploy.log	The script's step-by-step log — what it checked, downloaded, and decided.
C:\ProgramData\AciumSensor\Logs\msi-install.log	Windows Installer's verbose log for the MSI install.
C:\ProgramData\AciumSensor\Install\last-installed.json	State file recording the ETag and SHA256 of the last successfully installed package.

Exit codes

Code	Meaning
0	Success — installed, already up to date (no-op), or deferred pending a reboot
1	Download failed (sensor package or ASP.NET Core Runtime installer)
2	Could not secure the working/log directory (ACL hardening failed) — refused to proceed with a privileged install
3	Install failed (sensor MSI or ASP.NET Core Runtime installer)
4	Missing or invalid Script Variable (AgentDownloadUrl empty, or AgentOrganization contains a double quote)
5	Zip extraction failed / AciumSensorInstall.msi not found inside the package
6	MSI failed Authenticode signature verification against ExpectedPublisherCN

Verify

Confirm on the device itself — see Step 4: Verify the extension was deployed.

Note

For full troubleshooting guidance (including known msiexec error 1638 and ACL-hardening failure cases) see the syncro/ readme in the rmm-scripts repo — that's the source of truth for this script.