Skip to content

ImmyBot

ImmyBot is a software deployment and configuration platform popular with MSPs. You can use ImmyBot to silently deploy and maintain Enclave across your managed devices.

This guide covers the Enclave-specific configuration you will need. For general guidance on creating software entries and deployments in ImmyBot, refer to the ImmyBot documentation.

Overview

Deploying Enclave through ImmyBot involves three things:

  1. A software entry that tells ImmyBot how to install, detect and uninstall Enclave.
  2. An enrolment key for each customer tenant, stored as a parameter so ImmyBot can pass it to the installer at runtime.
  3. A deployment that targets the appropriate devices.

Installation

Enclave provides a PowerShell script and several installer packages designed for automated deployment via RMM platforms. The PowerShell script will install or update Enclave as needed, detect the system architecture, install any necessary dependencies and enrol the system using the provided enrolment key. See Windows unattended installation for the install command, available packages and usage guidance.

Configure ImmyBot to run the installation in an administrative context, passing the enrolment key for the target tenant. Store enrolment keys using ImmyBot's parameter or secrets capability rather than embedding them in plain text.

Detection

To detect whether Enclave is installed, check for the Enclave Windows service:

Get-Service -Name "Enclave" -ErrorAction SilentlyContinue

Uninstallation

See Windows unattended uninstallation for details on silently removing Enclave.

Enrolment keys

Each customer tenant has their own set of enrolment keys so that devices enrol into the correct Enclave organisation. We recommend creating at least one dedicated key for ImmyBot deployments so you can track and revoke it independently. Depending on how you use tags, you may want multiple enrolment keys to group installations by location, role or device type. See Enrolment keys for details.

Keeping Enclave updated

When Enclave is updated, the system will be briefly disconnected from the Enclave network while the new version starts. Active connections will be dropped and re-established, typically within 30 seconds. Consider scheduling updates for a time that minimises disruption.

If you used the PowerShell script to install, re-running the same script will update Enclave automatically. We recommend configuring ImmyBot to run it on a regular schedule so that Enclave stays current.

Next steps

Once devices are enrolled, you can manage tags, policies and DNS from the Enclave Portal. See the Getting Started guide for an introduction to configuring your Enclave network.

Last updated July 22, 2026