Install the Atlas Reach Agent on Windows

Install the Atlas AVD Endpoint Agent on your Windows session hosts using one installer per CPU architecture and an enrollment token per tenant.

Before you begin

  • An Atlas AVD administrator account (enrollment tokens are managed by administrators)
  • The Enable Atlas Agent setting on for the tenant (it is on by default)
  • Windows 10 (1809 or later), Windows 11, or Windows Server 2019 or later
  • Local administrator rights on each host (the agent installs as a per-machine service)
  • Outbound HTTPS (443) from each host to your Atlas AVD address

What the agent does

Once installed, the agent enrolls the host and then reports a sample every 60 seconds by default. Each sample carries whatever the host can read at that moment; anything unavailable is left out rather than guessed.

  • CPU, memory, disk, and network usage
  • Per-session experience metrics: frame rate, input latency, round-trip time, and available bandwidth (these exist only while a session is connected)
  • Active session count, logon duration, and FSLogix profile health
  • Once a day, an inventory of the hardware, operating system, and installed software

This guide is for Windows. For Macs and Linux machines, see Install the Atlas Reach Agent on macOS and Install the Atlas Reach Agent on Linux.

Step 1: Mint an enrollment token

The enrollment token ties a host to your tenant, so create it first. Open Atlas Reach (Atlas Operations → Reach in the sidebar), go to the Enrollment tab, and click New token. Give it a name, then click Mint token. The token has no expiry or device limit: it keeps working, including when you re-run the installer on the same machine, until you revoke it.

  • One token can enroll a whole rollout; you do not need one per host. Set a device limit if you want to cap it.
  • After minting, Atlas shows the token together with ready-made install commands. You can copy it again later from the Enrollment tokens list.
  • Delete a token to stop it enrolling new hosts. Devices it already enrolled keep their own credentials and keep reporting.

Step 2, Option A: Use the ready-made command

The quickest way to install on one host. After minting (or with the View install commands action on a token's row), choose the host's operating system: Windows · 64-bit (x64), Windows · 32-bit (x86), or Windows · ARM64. Atlas shows a one-liner for an elevated PowerShell window and one for an elevated Command Prompt that download the right installer and install it silently with your server address and token filled in, plus a plain msiexec command for a host that already has the installer.

Step 2, Option B: Install interactively (wizard)

Download the installer for the host's CPU from the Download Agent menu at the top of the Atlas Reach page (AtlasAvdAgent.msi for 64-bit, AtlasAvdAgent-x86.msi for 32-bit, AtlasAvdAgent-arm64.msi for ARM64), then:

  1. Copy the installer to the host and double-click it, then accept the license terms.
  2. On the Atlas AVD agent configuration page, enter the Atlas AVD server URL (the address your admins sign in to, for example https://atlas.contoso.com) and the Enrollment token from Step 1.
  3. Optionally set a sample interval in seconds (the default and minimum is 60). The host pool is detected automatically; there is nothing to enter for it.
  4. Click Next, choose the install folder, then Install. The agent installs as a service, enrolls the host, and starts reporting.

If the server URL or the enrollment token is empty, clicking Next shows a reminder and stays on the page: both are needed to enroll.

Step 2, Option C: Install silently across a fleet

The same installer runs unattended, so you can push it with Intune, Group Policy, or Configuration Manager. Supply the values as MSI properties:

  • ATLAS_SERVER_URL: required. Your Atlas AVD address.
  • ATLAS_ENROLLMENT_TOKEN: required on a new install. The token from Step 1.
  • ATLAS_SAMPLE_INTERVAL_SECONDS: optional. Defaults to 60 and is kept between 60 and 300.
  • ATLAS_AUTO_UPDATE: optional. Set to 0 if you push agent updates yourself instead of letting the agent update itself.
  • ATLAS_HOST_POOL_NAME: optional and rarely needed. Use it only where the host pool cannot be detected automatically.
msiexec /i AtlasAvdAgent.msi /qn ^
  ATLAS_SERVER_URL="https://atlas.contoso.com" ^
  ATLAS_ENROLLMENT_TOKEN="atlen_xxxxxxxx_..."

Building a golden image? Install the agent without a token so the secret is not captured in the image, then deliver the token at first boot (through Intune, Group Policy, or a first-run script). Each cloned host then enrolls as its own device.

Step 2, Option D: Install automatically on new AVD session hosts

For session hosts that Atlas builds, you don't need an image or management tool. Open the host pool, go to Settings → Remote Management, and turn on Install Atlas Reach on new session hosts. From then on, every session host Atlas builds in that pool gets the agent installed and enrolled automatically once it has joined the pool. A failed install never fails the build; it is written to the deployment log.

  • Enrollment token: by default, each new host gets a new single-use token that expires after an hour. To enroll every new host with a token you already use (for example, the one your Intune or golden-image rollout uses), pick it under Enrollment token on the same card.
  • If the chosen token is later revoked or deleted, new hosts are skipped and the deployment log says why. Atlas never quietly switches to a different token. Pick another token, then use Deploy to existing hosts to cover anything that was skipped.
  • Deploy to existing hosts, on the same card, installs the agent on the pool's running session hosts that are not enrolled yet.

One installer, one token per tenant

You never build or sign an installer per customer. The same signed installers are used everywhere, one per CPU architecture; the enrollment token you pass at install time decides which tenant each host joins. Give each tenant its own token and every host that receives it registers itself into the right tenant.

Step 3: Verify and approve

Within about a minute of install, the host appears on the Devices tab of Atlas Reach. New devices wait as Pending approval until an administrator clicks Approve on the device's row (unless the Auto-approve enrolled devices setting is on; it is off by default). Approving makes the device available for Atlas Reach and counts it as a billable unit; its metrics then flow into the host and session views.

If a host does not appear, check that it can reach your Atlas AVD address over HTTPS (443), that the server URL is right, and that the token has not expired, been deleted, or reached its device limit. The agent logs to the Windows Event Log under the source AtlasAvdAgent.

Updates, re-runs, and removal

  • The agent checks for a newer version once a day and updates itself after verifying the download. To update a device right away, use Check for update on it in Atlas Reach.
  • Installing a newer installer with no properties upgrades in place and keeps the existing configuration.
  • Re-running the installer with a valid token on the same host re-enrolls it with a fresh credential instead of creating a duplicate device, so it is safe to include in image updates.
  • To cut a device off, revoke it on the Devices tab. Its next report is rejected and it stops reporting.
  • To remove the agent, run the command below from an elevated Command Prompt, using the installer file name for the host's architecture. The service is stopped and removed. Uninstall the Atlas Reach Agent covers removing it without the installer file.
msiexec /x AtlasAvdAgent.msi /qn

Next steps