Install on Windows

Install the Roomler agent on Windows with the signed MSI, the setup wizard or one PowerShell line — and pick the right service mode for your machine.

Windows has three ways to run the agent, and the choice matters more here than on the other platforms: it decides whether the machine is reachable at the lock screen, before anyone logs in, and through a UAC prompt.

Pick a service mode first

Mode	Runs as	Reachable when…	Use it for
Machine — system	`LocalSystem`, Windows service	Always: lock screen, UAC prompts, before any user logs in	Servers, unattended workstations, anything you might need at 3 a.m.
Machine — attended	Windows service, no SystemContext	A user is logged in	Shared machines where you do not want pre-logon access
Per user	Scheduled task at logon, your own account	You are logged in	Your own laptop, or where you have no admin rights

Not sure?

Choose Machine — system. It is the mode that behaves the way people expect a remote-access tool to behave, and it is the only one that can get you back into a machine sitting at the lock screen.

Install

Roomler Setup needs no token. It is a signed EXE with a role picker:

Roomler Setup for Windows

If your network’s proxy refuses to download an EXE, take the same signed EXE in a zip instead.

Run it. Be accessed — background service is already selected. Change it if you want another mode, then continue to Join your organization.
Click Set up in the browser. The wizard shows a code of eight letters.
Open roomler.ai/pair, sign in or create an account, type the code, check the device the page shows, pick your organization and click Approve.
Go back to the wizard. It names who approved the device and into which organization. Click Install and answer the administrator prompt.

A code lasts 15 minutes. When it runs out the wizard says so, and Start again gives you a new one. A mistyped code only gets “No pending pairing with that code”.

Or one line, in an Administrator PowerShell (Terminal (Admin)), with a token you mint in the dashboard under Devices → Enroll device:

powershell

& ([scriptblock]::Create((irm https://roomler.ai/api/setup/install.ps1))) -Role daemon-system -Token <token> -Server https://roomler.ai

Swap -Role for daemon-machine (attended) or daemon-user (per user) to change the service mode.

Already installed and just need to enroll?

powershell

roomler enroll --server https://roomler.ai --token <token> --name "$env:COMPUTERNAME" --machine-global

Run elevated for a machine-wide install

daemon-system and daemon-machine register a Windows service, which needs administrator rights. Starting from a normal PowerShell prompt fails partway through rather than at the beginning.

What gets installed

Item	What it is
`roomlerd.exe`	The agent — remote-desktop target, mesh node, tunnel endpoint, SSH server
`roomler.exe`	The command-line tool. A small shim that re-execs the daemon’s own command surface, so the CLI and the daemon can never disagree about their version
`roomler-desktop.exe`	The tray companion: status, tunnels, and consent prompts
`wintun.dll` + the VC runtime	The virtual network adapter and its C runtime dependency

Two MSI flavours exist — per-user and per-machine. The wizard and the script pick the right one for the role you chose; you do not normally choose an MSI directly.

Verify what you installed

Every Windows binary is Authenticode-signed, and the MSI payload is signed before packaging. Check the publisher before you trust it:

powershell

Get-AuthenticodeSignature "C:\Program Files\Roomler\roomlerd.exe" |
  Select-Object Status, @{n='Signer';e={$_.SignerCertificate.Subject}}

Status should be Valid and the signer should name G ROX LTD. The agent’s own auto-updater applies the same two checks — a valid signature and the expected publisher — and refuses an update that fails either.

Then confirm it is running and enrolled:

powershell

roomler status

Where things live

Item	Path
Program files	`C:\Program Files\Roomler\` (per-machine) or `%LOCALAPPDATA%\Programs\Roomler\` (per-user)
Per-user config	`%APPDATA%\roomler\config.toml`
Machine-global config	`%PROGRAMDATA%\roomler\roomler\config.toml`

The config file holds a credential

config.toml contains the agent token, and — if you enable SSH — the SSH host private key. The machine-global directory is explicitly hardened at install time, because ProgramData’s default permissions are readable by all local users. Treat the file as a secret if you copy it anywhere.

Keeping it updated

The agent updates itself: it polls for a new release on a timer, verifies the signature and the publisher, checks that the artifact’s own embedded version matches what the release claimed, and only then hands off to the MSI. A build that crash-loops is rolled back to the last known-good version automatically.

Admins can also push a specific version to one device or the whole fleet from the dashboard.

Uninstall

Uninstall Roomler from Settings → Apps → Installed apps. If you registered a service by hand rather than through an installer:

powershell

roomlerd service uninstall

Then remove the device in the dashboard under Devices. That step matters: it revokes the machine’s credential and releases its mesh address back to the pool.

Troubleshooting

The device never appears. The enrollment token is single-use — if an earlier attempt consumed it, mint a fresh one.
Your company’s policy refuses the administrator prompt. Roomler Setup says so on its first page and selects Be accessed — this user only, which needs no administrator rights. For the background service, ask your administrator to install it.
An administrator typed their password for you. The window then runs as that administrator, so it offers only the background service for the whole computer. To install for your own account, close the window and start Roomler Setup again.
It appears, then goes stale. See device offline or stale.
Black screen when you connect. Usually a capture problem rather than a network one — see black screen.
Antivirus blocked the download. Installers are served through roomler.ai rather than GitHub precisely so corporate allow-lists can trust one origin. If yours blocks it, allow-list roomler.ai and retry.