Deploy WatchTower via NinjaOne RMM

Silent install, enrolment token, health check and uninstall for NinjaOne. Tested on a clean Windows 11 VM. Agent appears in the WatchTower console within two minutes.

Prerequisites

  1. Create an MSP workspace in WatchTower and generate an enrolment token from Settings → Enrolment tokens.
  2. The token is a long random string. Store it as a NinjaOne custom field or script variable.
  3. Each client organisation gets its own token. Devices enrol under the organisation whose token they use.
  4. Windows 10 22H2+ or Windows 11. The installer checks the OS version and exits with a message if unsupported.

1. Silent install script

Create a NinjaOne script (PowerShell). Set it to run as System or Administrator.

# NinjaOne WatchTower Agent Install
# Set WT_TOKEN as a script variable or custom field
param($WT_TOKEN)

$ErrorActionPreference = "Stop"
$url = "https://downloads.watchtower.example.com/agent/latest/wt-agent-setup.exe"
$tmp = "$env:TEMP\wt-agent-setup.exe"

# Download
Invoke-WebRequest -Uri $url -OutFile $tmp -UseBasicParsing

# Silent install with token
Start-Process -FilePath $tmp -ArgumentList "/S /TOKEN=$WT_TOKEN" -Wait

# Clean up
Remove-Item $tmp -Force

# Verify
$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if ($svc -and $svc.Status -eq "Running") {
    Write-Output "WatchTower agent installed and running."
    exit 0
} else {
    Write-Error "Agent service not found or not running."
    exit 1
}

2. Health-check script (RMM-readable)

Run as a periodic health check. NinjaOne can read the exit code and output.

# NinjaOne WatchTower Agent Health Check
$svc = Get-Service -Name "WatchTowerAgent" -ErrorAction SilentlyContinue
if (-not $svc) { Write-Output "Agent not installed"; exit 2 }
if ($svc.Status -ne "Running") { Write-Output "Agent not running"; exit 3 }

# Check last heartbeat (agent writes a timestamp file)
$hb = Get-Item "C:\ProgramData\WatchTower\heartbeat" -ErrorAction SilentlyContinue
if (-not $hb) { Write-Output "No heartbeat file"; exit 4 }

$age = (Get-Date) - $hb.LastWriteTime
if ($age.TotalMinutes -gt 10) { Write-Output "Heartbeat stale: $($age.TotalMinutes) min"; exit 5 }

# Check agent version
$ver = (Get-Item "C:\Program Files\WatchTower\wt-agent.exe").VersionInfo.ProductVersion
Write-Output "Agent OK v$ver, heartbeat $($age.TotalMinutes) min ago"
exit 0

3. Uninstall script

# NinjaOne WatchTower Agent Uninstall
$uninst = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Where-Object { $_.DisplayName -like "*WatchTower*" } | Select-Object -First 1

if ($uninst) {
    Start-Process -FilePath "msiexec.exe" -ArgumentList "/x $($uninst.PSChildName) /qn" -Wait
    Write-Output "WatchTower agent uninstalled."
} else {
    # Fallback: try the bundled uninstaller
    $exe = "C:\Program Files\WatchTower\uninstall.exe"
    if (Test-Path $exe) {
        Start-Process -FilePath $exe -ArgumentList "/S" -Wait
        Write-Output "WatchTower agent uninstalled via bundled uninstaller."
    } else {
        Write-Output "Agent not found."
    }
}
exit 0

Acceptance criteria

  • Install script exits 0 on a clean Windows 11 VM.
  • Device appears in the WatchTower console within two minutes.
  • Uninstall script removes the agent and exits 0.
  • Health check reports agent version and heartbeat age.

← Back to all RMM guides