SysKeep

Inventory agents

Download SysKeep for your estate.

Install the package for each operating system, enrol it into the correct organisation and verify the first report. Release status and checksums are shown beside every build.

Before you install

Create a secure enrolment token

  1. Sign in to SysKeep as an organisation Owner or Administrator.
  2. Open Organisation > Inventory API and create a short-expiry, device-limited enrolment token.
  3. Keep it private. Use the agent's hidden prompt or a root/SYSTEM-protected token file; never put it in a package, command argument, environment variable, SYSVOL or public script.
  4. After the deployment completes, revoke the enrolment token. Enrolled devices continue with their own unique credentials.

Customer workflow

From installer to a reporting device

The package is common to every customer. Organisation access is established only when an authorised customer administrator enrols the individual device.

  1. 01
    Create the token

    As a genuine Organisation Owner or Administrator, open Organisation > Inventory API. Give the token a short expiry and limit it to the intended number of devices.

  2. 02
    Install the package

    Use an administrator account on the device. The installer contains no organisation ID, enrolment token, device credential or release-signing private key.

  3. 03
    Enrol immediately

    Paste the sk_enroll_... value only into the hidden enrolment prompt. SysKeep returns a unique device-bound credential protected by the operating system.

  4. 04
    Verify and close the window

    Confirm the first accepted report in Assets and the installed version in Deployment Centre, then revoke the temporary enrolment token.

Updates remain controlled

A customer can approve manual or pilot targets in Deployment Centre. The current agent verifies signed metadata, approved HTTPS hosts, file size and SHA-256 before caching a package. It does not install, extract or execute that package.

Windows x64

SysKeep Agent 0.11.1

Unsigned controlled pilot

The Windows service reports operating system, hardware, monitors, installed software, security posture and Windows Update data. It also checks explicitly approved release metadata and independently verifies eligible downloads. The current MSI has not passed the production Authenticode signing gate, so deploy it only to a controlled pilot group.

Windows x64 MSIVersion 0.11.1 · 29.5 MB
Download MSI 334f3ce7...3b94dbd
Interactive installation
  1. Download the MSI and compare its complete SHA-256 value with SHA256SUMS.txt.
  2. Install it from an elevated PowerShell window and check the installer exit code.
  3. Run the enrolment command immediately and paste the temporary token into the hidden prompt.
  4. Start the service, request a foreground report if needed, and confirm the asset appears in the correct organisation.
Get-FileHash .\syskeep-agent-0.11.1-windows-x64-pilot.msi -Algorithm SHA256
$process = Start-Process msiexec.exe -Wait -PassThru -ArgumentList @(
  '/i', '"syskeep-agent-0.11.1-windows-x64-pilot.msi"', '/qn', '/norestart',
  '/L*v', ('"' + $env:TEMP + '\syskeep-agent-install.log"')
)
$process.ExitCode
& "$env:ProgramFiles\SysKeep Agent\SysKeep.Agent.exe" enroll
Start-Service SysKeepAgent
Get-Service SysKeepAgent
Get-Content "$env:ProgramData\SysKeep\Agent\logs\agent.log" -Tail 30

Look for Inventory accepted for asset .... In SysKeep, check Assets and Organisation > Deployment Centre. Revoke the temporary enrolment token after every intended device has enrolled.

Verify update eligibility

After a newer signed release has been published and this device has been explicitly targeted in Deployment Centre, run:

& "$env:ProgramFiles\SysKeep Agent\SysKeep.Agent.exe" check-update

up_to_date is the expected result when the installed version is current. An eligible package is verified and stored in the protected cache only; a customer administrator must still deploy the actual upgrade manually or through GPO.

Silent GPO deployment

Assign the MSI to computers from a read-only software share. Put the enrolment token in a different protected UNC file that only deployment administrators and the intended computer group can read. Use the supplied startup script and pass only that protected file path.

Download GPO enrolment script09f209e5...a6913b3
-EnrollmentTokenFile "\\fileserver\SysKeepSecrets\school-windows.enroll"

Once every intended computer has enrolled, revoke the token and remove its file. Do not delete %ProgramData%\SysKeep\Agent during an upgrade; it preserves the device identity and encrypted credential.

Ubuntu and Debian

SysKeep Agent 0.2.0

x64 verified

The Linux package installs a systemd service and reports device, operating system, network, disk and installed-software inventory. The x64 build has been verified on Ubuntu 26.04 LTS; the Arm64 build is available for native-hardware testing.

Ubuntu/Debian x64amd64 DEB · 30.3 MB
Download x64445f328b...a0461
Ubuntu/Debian Arm64arm64 DEB · 28.6 MB · hardware-unverified
Download Arm6498256c80...a0461
Install and enrol
  1. Check the machine architecture with dpkg --print-architecture and download the matching DEB.
  2. Install through APT, then run the hidden enrolment prompt.
  3. Check systemd, run diagnostics and request an immediate report.
cd ~/Downloads
sha256sum syskeep-agent-0.2.0-linux-amd64.deb
sudo apt install ./syskeep-agent-0.2.0-linux-amd64.deb
sudo syskeep-agent enroll
sudo syskeep-agent status
sudo syskeep-agent diagnose
sudo syskeep-agent report-now

apt remove syskeep-agent preserves the identity and credential. Use apt purge syskeep-agent only when intentionally retiring the device.

macOS 13 or later

SysKeep Agent 0.2.0

Technical preview
Release status

The agent has reported successfully from macOS, but the public Developer ID signed and Apple-notarised PKG is not ready yet. These are architecture-specific technical-preview and package-signing bundles, not final consumer installers.

Apple siliconM1, M2, M3 and M4 · signing bundle
Download Arm64185b529a...10764
Intel Macx86_64 · signing bundle
Download Intel36d14d7c...de211
Controlled technical-preview installation
  1. Run uname -m: use Arm64 for arm64, or Intel for x86_64.
  2. Verify and extract the archive. Remove only the downloaded archive quarantine metadata and apply a local ad-hoc signature; do not disable Gatekeeper globally.
  3. Run the installer, paste the enrolment token into its hidden prompt, then verify launchd and request a report.
cd ~/Downloads
shasum -a 256 syskeep-agent-0.2.0-macos-arm64-preview.tar.gz
mkdir -p syskeep-agent-macos-arm64
tar -xzf syskeep-agent-0.2.0-macos-arm64-preview.tar.gz -C syskeep-agent-macos-arm64
cd syskeep-agent-macos-arm64
chmod 755 syskeep-agent install-macos.sh uninstall-macos.sh
xattr -cr .
codesign --force --sign - --timestamp=none ./syskeep-agent
sudo ./install-macos.sh
sudo syskeep-agent status
sudo syskeep-agent diagnose
sudo syskeep-agent report-now
Build the Developer ID signed and notarised PKG

On the certificate-owning Mac, install Developer ID Application and Developer ID Installer identities, store notarisation credentials in Keychain with notarytool, then run the included builder. Private keys and Apple credentials must never be copied into the website bundle.

xcrun notarytool store-credentials "SysKeep-notary" --apple-id "YOUR_APPLE_ID" --team-id "YOUR_TEAM_ID"
./build-macos-pkg.sh \
  --runtime osx-arm64 \
  --application-identity "Developer ID Application: YOUR COMPANY (TEAMID)" \
  --installer-identity "Developer ID Installer: YOUR COMPANY (TEAMID)" \
  --notary-profile "SysKeep-notary"

The builder signs the hardened-runtime binary, signs the PKG, submits it to Apple, staples the accepted ticket and runs Gatekeeper assessment.

Integrity

Verify every download

Compare the complete SHA-256 value before installation, especially when a file has passed through a network share or management system.

Download SHA256SUMS