Get a token

In the console, open Add device and create a token. A device token lasts up to 7 days. For MDM and scripted rollouts, create a deployment token: it needs a name and lasts up to 90 days or until you revoke it. Revoking a token stops new enrollments; devices already enrolled stay enrolled.

Back to contents

One command

The fastest way for a single device. The script writes the token, installs the background service (pkg on macOS, deb or rpm on Linux, exe on Windows) and the service enrolls the device.

macOS and Linux, in Terminal

curl -fsSL https://pulse.offseq.com/install.sh | sudo sh -s -- --token '<TOKEN>'

Linux x86_64: Ubuntu 22.04+, Debian 12+, Fedora 36+. Not supported yet: RHEL, Rocky or Alma 9 (no WebKitGTK 4.1).

Windows, in PowerShell as administrator

To open it, right-click Start, then Terminal (Admin).

$env:PULSE_TOKEN='<TOKEN>'; irm https://pulse.offseq.com/install.ps1 | iex

To run without the tray app, add --silent at the end, or start with $env:PULSE_SILENT='1'; on Windows. The token stays in the shell history, so prefer a single-use token or revoke it once the device shows up.

The macOS app isn't notarized and the Windows installer isn't code-signed yet. Neither affects this command. If you open the Windows installer by hand, SmartScreen asks first: choose More info, then Run anyway.

Back to contents

Homebrew (macOS)

Homebrew asks you to trust third-party taps once:

brew tap offseq/tap && brew trust --tap offseq/tap

brew install --cask offseq/tap/offseq-pulse

The app isn't notarized yet, so clear the quarantine flag once:

xattr -dr com.apple.quarantine "/Applications/OffSeq Pulse.app"

Then open OffSeq Pulse from the menu bar, paste the token and choose Enroll. The cask installs the app only, without the background service that keeps reporting when nobody is signed in. For managed Macs, use the install command or your MDM.

Back to contents

Intune (Windows)

With the installer and /TOKEN

Download the Windows installer, rename it to OffSeqPulse_x64-setup.exe and wrap it with the Microsoft Win32 Content Prep Tool.
In Intune, add a Windows app (Win32), upload the .intunewin file and set the install command.
```
OffSeqPulse_x64-setup.exe /S /TOKEN=<TOKEN>
```

With the Provision USB files

Create a kit in Provision USB with the Windows installer included, into an empty folder. The kit carries its own token.
Wrap that folder with the Microsoft Win32 Content Prep Tool, with install.ps1 as the setup file.
In Intune, add a Windows app (Win32), upload the .intunewin file and set the install command.
```
powershell -ExecutionPolicy Bypass -File .\install.ps1
```

For either option

Install behavior: System. Detection rule: a custom script with this content.

if (Get-Service -Name OffSeqPulse -ErrorAction SilentlyContinue) { Write-Output "Installed" }

Uninstall command. It only succeeds once the device is unenrolled or revoked in the console.
```
powershell -ExecutionPolicy Bypass -Command "irm https://pulse.offseq.com/uninstall.ps1 | iex"
```
Assign the app to a device group. Devices enroll as the service starts.

Back to contents

Group Policy (Windows)

With a registry policy

Edit a GPO linked to the computers: Computer Configuration, Preferences, Windows Settings, Registry. Add HKLM\SOFTWARE\Policies\OffSeq\Pulse, value EnrollToken (REG_SZ) set to the token. To try it on one device first:
```
reg add "HKLM\SOFTWARE\Policies\OffSeq\Pulse" /v EnrollToken /t REG_SZ /d "<TOKEN>" /f
```
Install the Windows installer with your software deployment tool or a startup script: OffSeqPulse_x64-setup.exe /S.

With a computer startup script

Create a kit in Provision USB (it carries its own token) and copy it to \\server\share\pulse, readable by Domain Computers. Save this next to it as start.ps1:

# start.ps1: install only where the service is missing; the kit's install.ps1 carries the token.
if (-not (Get-Service -Name OffSeqPulse -ErrorAction SilentlyContinue)) {
  Set-Location \\server\share\pulse
  & .\install.ps1
}

Edit a GPO linked to the computers: Computer Configuration, Policies, Windows Settings, Scripts, Startup. Add script powershell.exe with these parameters:
```
-ExecutionPolicy Bypass -File \\server\share\pulse\start.ps1
```

Users on the network can read the share and policy values, so use a deployment token and revoke it when the rollout is done.

Back to contents

Jamf, Kandji, Mosyle (macOS)

Works with Jamf Pro, Kandji, Mosyle and any MDM that can run a script before a package.

Add this as a pre-install script. It writes the token where the agent's service reads it.

#!/bin/sh
set -e
dir="/Library/Application Support/OffSeq Pulse"
mkdir -p "$dir"
( umask 077; printf '%s' '<TOKEN>' > "$dir/enroll-token" )
chmod 600 "$dir/enroll-token"

Upload the macOS package (.pkg) and deploy it after the script. The package installs the background service, which enrolls the Mac.

Or with a configuration profile

Push a custom settings profile for the domain com.offseq.pulse with the key EnrollToken, then deploy the package. The token stays in the profile, so nothing sits on disk in plain text.

Replace <TOKEN> in EnrollToken before uploading.

Back to contents

Ansible (Linux)

Store the token in Ansible Vault so it stays out of the playbook.

printf '%s' '<TOKEN>' | ansible-vault encrypt_string --stdin-name pulse_token

Run this play. It uses the same install script as the install command and skips hosts that already have the agent.

- name: Install OffSeq Pulse
  hosts: all
  become: true
  tasks:
    - name: Install the agent and enroll
      when: ansible_system == "Linux"
      ansible.builtin.shell: set -o pipefail; curl -fsSL https://pulse.offseq.com/install.sh | sh
      environment:
        PULSE_TOKEN: "{{ pulse_token }}"
      args:
        executable: /bin/bash
        creates: /usr/bin/offseq-pulse
      no_log: true

Linux x86_64: Ubuntu 22.04+, Debian 12+, Fedora 36+. Not supported yet: RHEL, Rocky or Alma 9 (no WebKitGTK 4.1).

Back to contents

USB and offline

For devices without easy network access, Provision USB in the console writes the install scripts, a token and the installers (pkg, deb, rpm and exe) onto a drive.

macOS and Linux

sudo sh /path/to/drive/install.sh

Windows, in PowerShell as administrator, from the drive folder

powershell -ExecutionPolicy Bypass -File .\install.ps1

Files extracted from a downloaded zip carry Windows' mark of the web. If Windows warns about them, unblock them first from the drive folder:

Get-ChildItem -Recurse | Unblock-File

The token is on the drive in plain text. Keep the drive with you and wipe it when you're done.

Back to contents

Agent already installed

Open OffSeq Pulse on the device, paste the token and choose Enroll, or run the one command again: it reinstalls in place and enrolls.

From the command line

Reads the token from standard input, so it stays out of the process list.

printf '%s' '<TOKEN>' | sudo offseq-pulse enroll --token-file -

printf '%s' '<TOKEN>' | sudo "/Applications/OffSeq Pulse.app/Contents/MacOS/offseq-pulse" enroll --token-file -

'<TOKEN>' | & "$env:ProgramFiles\OffSeq Pulse\offseq-pulse.exe" enroll --token-file -

Back to contents

Uninstall

First unenroll or revoke the device in the console under Devices. Unenroll asks the agent to remove itself at its next check-in; Revoke frees the device slot at once, even when the device is offline. Until then an enrolled agent refuses local removal.

macOS and Linux

curl -fsSL https://pulse.offseq.com/uninstall.sh | sudo sh

Windows, in PowerShell as administrator

irm https://pulse.offseq.com/uninstall.ps1 | iex

Emergency removal, when the console is unreachable: set PULSE_ALLOW_UNINSTALL=1 for the uninstall script.

Back to contents

Troubleshooting

Check the agent

Shows whether the service runs, the enrollment state, the last check-in and the last error.

sudo offseq-pulse status

sudo "/Applications/OffSeq Pulse.app/Contents/MacOS/offseq-pulse" status

& "$env:ProgramFiles\OffSeq Pulse\offseq-pulse.exe" status

Common causes

Device limit reached. Revoke a device or email support@offseq.com to raise the limit, then restart the service or run the command again.
Invalid or expired token. The token ran out of uses, expired or was revoked. Create a new one.
No network. The device needs HTTPS to pulse.offseq.com on port 443.
Linux package won't start. Linux x86_64: Ubuntu 22.04+, Debian 12+, Fedora 36+. Not supported yet: RHEL, Rocky or Alma 9 (no WebKitGTK 4.1).

Still stuck? Contact us with the output of the check above.

Back to contents