Installing PowerShell Orchestrator Agent
The PowerShell Orchestrator Agent is deployed on each Windows machine where you want to execute PowerShell scripts remotely. Agents register automatically with the server on first connection, poll for queued jobs, execute assigned scripts locally, and forward script output to the configured syslog destination. The agent must be installed individually on every machine in scope for script execution.
Prerequisites:
Before installing the agent confirm the following:
- The PowerShell Orchestrator Server is installed and running
- The server web interface is accessible at https://<server-name>:52866
- The agent machine has network access to the server on port 52866
- PowerShell 5 or PowerShell Core 7 is available on the agent machine
- Administrator privileges are available on the target machine
- If using the auto-generated self-signed certificate, the server certificate has been exported for trust configuration on the agent
Step 1 — Run the installer:
Locate the agent installation package:
LTA_PSOrchestrator_Agent.msi
Double-click the MSI file and follow the installation wizard prompts.
Step 2 — Configure server connection:
During installation you will be prompted for the following connection details:
| Prompt | Description |
| Server Host | The IP address or hostname of the PowerShell Orchestrator Server |
| Server Port | The HTTPS port of the server — default: 52866 |
| Certificate File (optional) | Path to the server’s exported .cer certificate file for validation |
Enter these values when prompted and complete the installation wizard.
The agent installs to a default location and creates the following service:
| Service Name | Description |
| PowerShellOrchestrator.Agent | The agent Windows service — starts automatically after installation |
Agent configuration:
The agent is configured through appsettings.json in the agent installation directory. Key configuration options:
| Setting | Description | Default |
| AgentId | Unique identifier for this agent — set to AUTO for automatic generation | AUTO |
| ServerUrl | Full HTTPS URL to the PowerShell Orchestrator Server | Set during install |
| PollSeconds | How often in seconds the agent checks for new jobs | 20 |
| HeartbeatSeconds | How often in seconds the agent sends a heartbeat to the server | 60 |
| StorageRoot | Directory for storing downloaded scripts and execution logs | C:ProgramDataPSOrchestratorAgent |
| MaxStoredDays | Number of days to retain job execution logs | Set during install |
| DefaultTimeoutSeconds | Maximum allowed script execution time before timeout | Set during install |
| PowerShellVersion | PowerShell version to use for script execution — 5 or 7 | Set during install |
After modifying appsettings.json restart the agent service to apply changes:
Restart-Service PowerShellOrchestrator.Agent
Step 3 — Verify the agent service is running:
Confirm the agent service started successfully:
Get-Service PowerShellOrchestrator.Agent
The service should show as Running.
Step 4 — Verify agent registration:
After the service starts the agent automatically registers with the PowerShell Orchestrator Server on its first connection:
- Log in to the PowerShell Orchestrator Server web interface at https://<server-name>:52866
- Navigate to Clients in the main navigation
- Confirm the new agent appears in the client list
- Confirm the agent status shows Online
If the agent does not appear in the Clients page check the following:
- Confirm the agent service is running
- Verify the ServerUrl in appsettings.json points to the correct server address and port
Test network connectivity from the agent to the server:
Test-NetConnection -ComputerName <server-ip> -Port 52866
- Confirm the server certificate is trusted on the agent machine
Review the agent logs for connectivity or certificate errors:
C:ProgramDataPSOrchestratorAgentlogs
TLS certificate trust configuration:
If the PowerShell Orchestrator Server is using the auto-generated self-signed certificate, configure the agent to trust it using one of the following methods:
Option A — Install the server certificate on the agent:
- Export the server certificate from the PowerShell Orchestrator Server:
Get-ChildItem Cert:LocalMachineMy |
Where-Object Subject -like “*LTA-Orchestrator*” |
Export-Certificate -FilePath server.cer
- Copy server.cer to the agent machine
- Import the certificate into the agent’s trusted root store:
Import-Certificate -FilePath server.cer `
-CertStoreLocation Cert:LocalMachineRoot
- Restart the agent service:
Restart-Service PowerShellOrchestrator.Agent
Option B — Provide the certificate file during installation: When prompted for a Certificate File during agent installation, provide the path to the exported .cer file. The installer will configure trust automatically.
For production deployments use a CA-issued certificate on the PowerShell Orchestrator Server. This eliminates the need for manual certificate trust configuration on each agent machine.
Agent storage locations:
| Location | Purpose |
| C:ProgramDataPSOrchestratorAgent | Main agent storage directory |
| C:ProgramDataPSOrchestratorAgentscripts | Downloaded PowerShell scripts |
| C:ProgramDataPSOrchestratorAgentlogs | Job execution logs |
| Agent installation directory appsettings.json | Agent configuration file |
Deploying agents across multiple machines:
The PowerShell Orchestrator Agent must be installed individually on each Windows machine in scope for script execution. For large deployments consider using enterprise software deployment tools to automate agent installation across multiple machines simultaneously.
[Your administrator should document all machines with the PowerShell Orchestrator Agent installed and confirm each one appears in the Clients page after deployment.]