Deploy WatchTower via Datto RMM

Silent install, enrolment token, health check and uninstall for Datto RMM. Tested on a clean Windows 11 VM.

Prerequisites

  1. Create an MSP workspace and generate an enrolment token from Settings → Enrolment tokens.
  2. Store the token as a Datto RMM site-level variable. Use different tokens per client site.
  3. Windows 10 22H2+ or Windows 11.

1. Silent install (Datto RMM Component)

Create a Datto RMM Component of type PowerShell. Set the input variable WT_TOKEN.

# Datto RMM WatchTower Agent Install Component
$ErrorActionPreference = "Stop"
$token = $env:WT_TOKEN
if (-not $token) { Write-Error "WT_TOKEN not set"; exit 1 }

$url = "https://downloads.watchtower.example.com/agent/latest/wt-agent-setup.exe"
$tmp = "$env:TEMP\wt-agent-setup.exe"

Invoke-WebRequest -Uri $url -OutFile $tmp -UseBasicParsing
Start-Process -FilePath $tmp -ArgumentList "/S /TOKEN=$token" -Wait
Remove-Item $tmp -Force

$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -eq "Running") {
    Write-Output "WatchTower agent installed and running."
    exit 0
} else {
    Write-Error "Agent service not found or not running."
    exit 1
}

2. Health check (Datto RMM Monitor)

Create a Datto RMM Monitor Component. Run every 15 minutes.

# Datto RMM WatchTower Agent Health Monitor
$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if (-not $svc) { Write-Output "Agent not installed"; exit 2 }
if ($svc.Status -ne "Running") { Write-Output "Agent not running"; exit 3 }

$hb = Get-Item "C:\ProgramData\WatchTower\heartbeat" -ErrorAction SilentlyContinue
if (-not $hb) { Write-Output "No heartbeat file"; exit 4 }

$age = (Get-Date) - $hb.LastWriteTime
if ($age.TotalMinutes -gt 10) { Write-Output "Heartbeat stale: $([math]::Round($age.TotalMinutes)) min"; exit 5 }

$ver = (Get-Item "C:\Program Files\WatchTower\wt-agent.exe").VersionInfo.ProductVersion
Write-Output "Agent OK v$ver"
exit 0

3. Uninstall (Datto RMM Component)

# Datto RMM WatchTower Agent Uninstall Component
$uninst = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Where-Object { $_.DisplayName -like "*WatchTower*" } | Select-Object -First 1

if ($uninst) {
    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x $($uninst.PSChildName) /qn" -Wait
    Write-Output "WatchTower agent uninstalled."
} else {
    $exe = "C:\Program Files\WatchTower\uninstall.exe"
    if (Test-Path $exe) {
        Start-Process -FilePath $exe -ArgumentList "/S" -Wait
        Write-Output "WatchTower agent uninstalled via bundled uninstaller."
    } else {
        Write-Output "Agent not found."
    }
}
exit 0

Acceptance criteria

  • Install component exits 0 on a clean Windows 11 VM.
  • Device appears in the WatchTower console within two minutes.
  • Uninstall component removes agent and exits 0.
  • Monitor reports version and heartbeat age.

← Back to all RMM guides