Deploy WatchTower via N-able

Silent install, enrolment token, health check and uninstall for N-able N-central and N-sight RMM. Tested on a clean Windows 11 VM.

Prerequisites

  1. Generate an enrolment token from Settings → Enrolment tokens. Each client gets its own token.
  2. Store the token as an N-able custom property (N-central) or script variable (N-sight).
  3. Windows 10 22H2+ or Windows 11.

1. Silent install (N-central Automation Policy / N-sight Check)

N-central: create an Automation Policy with a PowerShell step. N-sight: create a PowerShell Check. Set the WT_TOKEN variable.

# N-able WatchTower Agent Install
$ErrorActionPreference = "Stop"
# N-central: read custom property
$token = Get-NCentralProperty -Name "WT_TOKEN"
# N-sight: read script argument
if (-not $token) { $token = $args[0] }
if (-not $token) { Write-Error "WT_TOKEN not set"; exit 1 }

$url = "https://downloads.watchtower.example.com/agent/latest/wt-agent-setup.exe"
$tmp = "$env:TEMP\wt-agent-setup.exe"

Invoke-WebRequest -Uri $url -OutFile $tmp -UseBasicParsing
Start-Process -FilePath $tmp -ArgumentList "/S /TOKEN=$token" -Wait
Remove-Item $tmp -Force

$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -eq "Running") {
    Write-Output "WatchTower agent installed and running."
    exit 0
} else {
    Write-Error "Agent service not found or not running."
    exit 1
}

2. Health check (N-central Service Monitor / N-sight Check)

N-central can also monitor the Windows service directly. This script adds the heartbeat check.

# N-able WatchTower Agent Health Check
$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if (-not $svc) { Write-Output "Agent not installed"; exit 2 }
if ($svc.Status -ne "Running") { Write-Output "Agent not running"; exit 3 }

$hb = Get-Item "C:\ProgramData\WatchTower\heartbeat" -ErrorAction SilentlyContinue
if (-not $hb) { Write-Output "No heartbeat file"; exit 4 }

$age = (Get-Date) - $hb.LastWriteTime
if ($age.TotalMinutes -gt 10) { Write-Output "Heartbeat stale: $([math]::Round($age.TotalMinutes)) min"; exit 5 }

$ver = (Get-Item "C:\Program Files\WatchTower\wt-agent.exe").VersionInfo.ProductVersion
Write-Output "Agent OK v$ver"
exit 0

3. Uninstall (N-central Automation Policy / N-sight Script)

# N-able WatchTower Agent Uninstall
$uninst = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Where-Object { $_.DisplayName -like "*WatchTower*" } | Select-Object -First 1

if ($uninst) {
    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x $($uninst.PSChildName) /qn" -Wait
    Write-Output "WatchTower agent uninstalled."
} else {
    $exe = "C:\Program Files\WatchTower\uninstall.exe"
    if (Test-Path $exe) {
        Start-Process -FilePath $exe -ArgumentList "/S" -Wait
        Write-Output "WatchTower agent uninstalled via bundled uninstaller."
    } else {
        Write-Output "Agent not found."
    }
}
exit 0

Acceptance criteria

  • Install script exits 0 on a clean Windows 11 VM.
  • Device appears in WatchTower console within two minutes.
  • Uninstall script removes agent and exits 0.

← Back to all RMM guides