Deploying GaiaDesk to your organisation

With an Enterprise plan you can hand the machines you support a GaiaDesk that is already connected to your team, shows your name and logo, and has the settings you choose — some of them locked. You do not rebuild or re-sign anything: every machine runs the official, signed GaiaDesk installer. What makes it yours is a small provisioning bundle that you download from your Team page and ship next to the installer.

The bundle is signed by the GaiaDesk server. GaiaDesk checks that signature before it uses anything in the bundle, so a bundle that has been edited, or one that tries to point machines at another server, is refused.

What a bundle can and cannot do

A bundle can:

• enrol the machine as an endpoint of your team, so it appears in your device pool with a stable ID (managed mode);

• set your brand: name, logo (PNG, JPEG or WebP, up to 32 KB), accent colour and a support contact, shown in the app, next to the words "powered by GaiaDesk";

• set defaults: who may connect (allow-list), locking the computer when a session ends, disconnecting idle sessions, several devices at once, the picture mode, clipboard and file-transfer permissions, and whether to ask for unattended access;

• lock any of those, so the user cannot change them. A lock is enforced by GaiaDesk itself, not only greyed out: the setting cannot be changed from anywhere in the app. Locked settings show "Managed by <your brand>".

A bundle cannot:

• hide the tray / menu-bar icon, the "someone is connected" notification or the in-session panel. Whoever is at the machine is always told when a session is live. No setting in the bundle format can change this.

• turn on unattended access without the operating system's own administrator prompt;

• change the window title, or rename GaiaDesk anywhere GaiaDesk's own name is needed for the user to know what is running;

• give your technicians access to a machine by itself. Technicians still connect with the machine's unattended password (set locally) or with its one-time code and the user's approval, and only from the accounts on your allow-list.

1. Create a profile

In the web app, open Team → Deployment (team owners and admins, Enterprise plan) and choose New profile:

• Mode — Managed device for machines your IT team looks after, or On-demand support client for customers who call you for help (see the embedding guide).

• Brand — name, accent colour, support contact and logo.

• Defaults and locks — as above. Leave a default on "Leave as is" to keep each machine's own value.

2. Download the bundle

Choose Download bundle on the profile. You get gaiadesk-provision.json. Each download:

• is valid for 90 days by default (up to 365) — this bounds how long it can be used to enrol machines, not how long enrolled machines stay managed;

• carries its own enrolment token, limited by default to your endpoint allowance. The token can only add machines to this profile's pool; it cannot read anything or reach your other machines;

• has a serial number higher than every earlier bundle for the profile. GaiaDesk never goes back to an older bundle than one it has already applied, so re-running an old script cannot undo a newer profile.

Treat the file like a door key for your device pool: anyone holding it can add machines to your pool until it expires, is used up, or you revoke it.

3. Install silently

Windows (Intune, SCCM, Group Policy)

Put gaiadesk-provision.json in the same folder as the installer and run, as SYSTEM or an administrator:

GaiaDesk_<version>_x64-setup.exe /S

The installer copies the bundle into %ProgramData%\GaiaDesk\provision.json, a folder only administrators can write, and GaiaDesk applies it for every user the next time it starts. Because only an administrator could have put it there, it is applied without asking.

macOS (Jamf, Kandji, Mosyle — as root)

hdiutil attach -nobrowse GaiaDesk_<version>_aarch64.dmg
cp -R /Volumes/GaiaDesk/GaiaDesk.app /Applications/
hdiutil detach /Volumes/GaiaDesk
/Applications/GaiaDesk.app/Contents/MacOS/gaiadesk-desktop --provision gaiadesk-provision.json

Run as root, --provision checks the signature and installs the bundle to /Library/Application Support/GaiaDesk/provision.json, where every user's GaiaDesk picks it up. It prints one line of JSON and exits 0 when installed, 2 when the bundle was refused (the reason is in the JSON).

Linux (as root)

apt install ./GaiaDesk_<version>_amd64.deb
gaiadesk-desktop --provision gaiadesk-provision.json

The bundle goes to /etc/gaiadesk/provision.json.

One user, no administrator

gaiadesk-cli provision gaiadesk-provision.json
gaiadesk-cli provision https://files.yourcompany.com/gaiadesk-provision.json

Without administrator rights the bundle is not applied straight away: GaiaDesk shows the user who is asking to manage it and what that means, and applies it only if they choose Accept. The CLI only fetches https:// URLs, and never more than a bundle's size.

Unattended access

If the profile asks for unattended access, GaiaDesk asks the user (or the administrator) to turn it on with the operating system's normal admin prompt. Nothing is installed silently.

4. Manage endpoints

Team → Deployment lists:

• Enrolled endpoints — each machine's name, OS, GaiaDesk ID and when it was last seen. Revoke removes a machine from your pool: it stops being reachable as your endpoint within 12 hours and frees its slot.

• Enrolment tokens — one per downloaded bundle, with its use count. Revoke stops that bundle enrolling any more machines. Machines it already enrolled stay enrolled.

• Deployment audit — every profile change, bundle download, enrolment and revocation, with who did it.

Your endpoint allowance is part of your Enterprise agreement (100 by default). An endpoint is a machine, not a person: it does not use a seat.

Updating a profile

Change the profile, download a new bundle, and ship it the same way. Machines apply the newer serial on their next start. Defaults are applied once per bundle, so a user's own change to an unlocked setting sticks until the next bundle; locked settings are always yours.

Removing management

• A user who accepted a bundle themselves can remove it in the app.

• A bundle an administrator placed machine-wide can only be removed by an administrator: delete the provision.json above (uninstalling GaiaDesk on Windows removes it) and revoke the machine in Team → Deployment.