A device becomes manageable only after the remFREE agent is installed and successfully enrolled with an organization.
Enrollment establishes the trusted relationship between the endpoint and the remFREE platform.
Before you begin
You will need:
- access to the remFREE organization where the device should appear
- permission to enroll devices
- administrator or elevated permissions on the endpoint
- outbound HTTPS connectivity to remFREE
The endpoint must be able to reach:
https://rmm.remfree.com
Persistent agent communication uses:
wss://rmm.remfree.com/ws
Get the enrollment command
Sign in to remFREE and open Devices → Download Agent.
The Download Agent page provides the current installation command and a short-lived enrollment token.
Enrollment tokens are intentionally temporary.
Treat an enrollment token like a credential. Do not store it in permanent documentation, public scripts, chat systems, or other long-lived locations.
Install the agent
Run the installation command using the appropriate administrative context for the operating system.
The installation process places the remFREE agent on the endpoint, configures the required service behavior, and supplies the information required for initial enrollment.
What happens during enrollment?
The agent sends an enrollment request to remFREE.
If the enrollment token is valid, remFREE associates the endpoint with the correct tenant and establishes the device identity used for future communication.
The device can then begin normal authenticated agent communication without repeatedly using the original enrollment token.
What happens next?
After enrollment, the agent begins checking in with remFREE.
The platform can then begin receiving information such as:
- device heartbeat
- agent version
- operating system information
- inventory
- supported compliance evidence
- job results
A Reboot is required for Windows agents.
Other collection workflows may occur depending on the current remFREE configuration.
How do I know enrollment worked?
Open Devices in remFREE.
The endpoint should appear in the device list.
Once communication begins, remFREE will record its most recent contact and display the device's current operational status.
Re-enrollment
A device normally should not need to be enrolled repeatedly.
Re-enrollment may be appropriate when:
- the original device record was intentionally removed
- the operating system was rebuilt
- the device identity was lost
- the agent installation was completely removed
- the endpoint needs to be enrolled into a different organization
Avoid creating duplicate device records unless that is intentional.
Why enrollment is separate from normal communication
Enrollment and ordinary device communication solve two different security problems.
Enrollment answers:
Should this new endpoint be allowed to become part of this organization?
Normal authenticated communication answers:
Is this already-enrolled endpoint really the device it claims to be?
Keeping these steps separate reduces the amount of long-lived enrollment material required and provides a cleaner trust boundary.
A zero-trust mindset
remFREE was shaped by work in environments where privileged access could not simply be assumed.
Enrollment follows the same philosophy:
- establish identity intentionally
- authenticate subsequent communication
- associate endpoints with the correct tenant
- expire temporary enrollment credentials
- leave evidence of administrative activity
The goal is controlled, observable device management.