--- updatedAt: 2026-09-16T02:21:39.000Z --- # Deploy Jump Clients | PRA Jump Clients can be preinstalled on remote computers in anticipation of the need for remote access. This method of installation may be applied to one system or multiple systems simultaneously. You can easily automate the mass deployment of your Jump Client network by allowing customization during installation. The Jump Client command line installer has switches that allow a script to modify a variety of Jump Client parameters when executed. This allows you to create custom mass deployment scripts to pull in variables from other sources and use the variables to modify the Jump Client parameters at install time. ## Jump Client installer list The Jump Client installer list shows existing Jump Client installers and the ability to add a new Jump Client. To add a new Jump Client, see [Jump Client Mass Deployment Wizard](#jump-client-mass-deployment-wizard). A warning appears at the top of the list: *Installing more than one Jump Client as the same user or more than one Jump Client as a service on the same system is being phased out in a future release. In the Access Console you may use the copy action on a Jump Client to apply different policies to the same endpoint.* Click **Dismiss** to hide the message. * Click ![Image of the icon that allows you to download the installer, email the direct download link to recipients, or copy the direct download link to your clipboard.](https://files.readme.io/b52f5fdb247c6ed1129067cbb81f203010cb5585d4232bc3ed21130a283a83c6-share.png) and then select a platform to either download the installer, email the direct download link to recipients, or copy the direct download link to your clipboard. * Click ![Image of the icon used to view the key info to be used with the generic Jump Client installer](https://files.readme.io/b1a0611f53bb194bf25976568845cdf84c4499b778a037a868a3a8626d8dcee4-key.png) and then select a platform to view the key info to be used with the generic Jump Client installer. * Click ![Image of the icon used change how long the installer is valid.](https://files.readme.io/ba1fdee03a901e405ff7be1e7914ee27cada39ede18081e950dc27b664211a1e-clock.png) to change how long the installer is valid. * Click ![Image of the icon used to delete the Jump Client installer.](https://files.readme.io/7dbda1863dfb1ed58dd266f14838aa675e11adba365fc41a8313d3300be95346-trash.png) to delete the Jump Client installer. This does not delete any Jump Clients that use this installer. ## Jump Client Mass Deployment Wizard To create a new Jump Client installer, click **Add** at the top of the Jump Client Installer List. The Mass Deployment Wizard enables administrators and privileged users to deploy Jump Clients to one or more remote computers for later unattended access. The only field that is required is **Asset Group**. After all fields have been completed, click **Create**. > ℹ️ > > **Allow override during installation:** Some Mass Deployment Wizard settings allow override, enabling you to use the command line to set parameters that are specific to your deployment, prior to installation. [block:parameters] { "data": { "h-0": "Field Name", "h-1": "Description", "0-0": "**Asset Group**", "0-1": "From the **Asset Group** dropdown box, select whether to pin the Jump Client to your personal list of Assets or to an Asset Group shared by other users. Pinning to your personal list of Assets means that only you (and higher ranking roles on your team, such as Team Lead and Team Manager if you are a Team Member, and Team Manager if you are a Team Lead) can access this remote computer through this Jump Client. Pinning to a shared Asset Group makes this Jump Client available to all members of that Asset Group.", "1-0": "**This installer is Valid For**", "1-1": "The installer remains usable only as long as specified by the **This Installer is Valid For** dropdown. Be sure to leave adequate time for installation. If you attempt to run the Jump Client installer after this time, installation fails. You can extend the time the installer is valid by clicking ![Image of the icon used to change how long the installer is valid](https://files.readme.io/ba1fdee03a901e405ff7be1e7914ee27cada39ede18081e950dc27b664211a1e-clock.png). Additionally, if the installer is run within the allotted time but the Jump Client is unable to connect to the Appliance within that time, the Jump Client uninstalls, and a new installer must be deployed. The validity time can be set for anywhere from 10 minutes to 1 year. This time does **not** affect how long the Jump Client remains active. \n \nOnce a Jump Client has been installed, it remains online and active until it is uninstalled from the local system either by a logged-in admin user with appropriate permissions, by a user from the Asset Management Interface, or by an uninstall script. It can also be uninstalled, or extended, from the Jump Client Installer List. A user cannot remove a Jump Client unless the user is given appropriate permissions by their Remote Support admin.", "2-0": "**Name**", "2-1": "Enter a name for the Asset. This name identifies the item in the session tabs. This string has a maximum of 128 characters.", "3-0": "**Comments**", "3-1": "Add comments, which can be helpful in searching for and identifying remote computers.", "4-0": "**Asset Policy**", "4-1": "You can apply a **Asset Policy** to this Jump Client. Asset Policies are configured on the **Asset Management > Asset Policies** page and determine the times during which a user can access this Jump Client. If no Asset Policy is applied, this Jump Client can be accessed at any time.", "5-0": "**Tag**", "5-1": "Adding a tag helps to organize your Jump Clients into categories within the representative console.", "6-0": "**Session Policy**", "6-1": "Choose a session policy to assign to this Jump Client. The session policy assigned to this Jump Client has the highest priority when setting session permissions.", "7-0": "**Gateway Proxy**", "7-1": "When a Jump Client is first deployed, if it cannot connect to the Appliance, it searches the local network for a Gateway or Gateway cluster serving as a Proxy. This allows a Jump Client installed on a system without a native internet connection to use the Gateway to connect back to the Appliance. \n \nIn the special case where the Jump Client and Gateway are not on the same local network or where a firewall blocks the Jump Client's attempt to connect to the Gateway, the **Gateway Proxy** setting allows you to set which Gateway the Jump Client should try to use as a proxy. This setting is used by Jump Clients that cannot use multicast DNS to retrieve proxy information from a Gateway.", "8-0": "**Maximum Offline Minutes Before Deletion**", "8-1": "The maximum number of minutes a Jump Client will be offline before it is deleted from the system. This setting will override the global setting if specified." }, "cols": 2, "rows": 9, "align": [ "left", "left" ] } [/block] [block:image] { "images": [ { "image": [ "https://files.readme.io/0823edb53bad45a2e49dd947f7760a641dcc35ef3ab34b2402b0bddec0ad3513-pf-jc-iinstaller.png", "", "Image of the Jump Client Mass Deployment Wizard." ], "align": "center", "border": true } ] } [/block] Once you click **Create**, you can download the Jump Client installer immediately, copy the link for later use, or email the installer to remote users. Multiple recipients can install from the same link. 1. The **Platform** dropdown defaults to your operating system. Select a different platform if you plan to deploy on another OS. 2. Choose an option to download or distribute the Jump Client installer. * Download the installer immediately to run locally or distribute with a systems management tool. * Copy a direct download link or a cURL/wget/btapi command. * Email the installer link to one or more recipients. 3. Run the installer. The Jump Client attempts to connect to the B Series Appliance. If successful, it appears in the Asset Management Interface of the representative console. If it cannot connect right away, it keeps retrying until it succeeds. If it fails to connect within the time set by **This Installer Is Valid For**, it uninstalls automatically and must be redeployed. ## Install on Windows systems For system administrators who need to push out the Jump Client installer to a large number of systems, the Windows MSI can be used with your systems management tool of choice. When using a command line or system management tool to install, you can override certain installation parameters. For any setting with **Allow override during installation** checked, you can modify the Jump Client installer with the following parameters for each installation. > ℹ️ > > If a parameter is passed on the command line but the setting is not marked for override in the administrative interface, the installation fails. View the operating system event log for installation errors. | Command line parameter | Value | Description | | ----------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | KEY_INFO= | \ | Specifies a keyinfo parameter required to install the generic Jump Client installer. | | INSTALLDIR= | \ | Specifies a new writable directory under which to install the Jump Client. This is supported only on Windows and Linux. When defining a custom install directory, ensure that the directory you are creating does not already exist and is in a location that can be written to. | | JC_NAME= | \ | If override is allowed, this command line parameter sets the Jump Client's name. | | JC_JUMP_GROUP= | user: \
jumpgroup: \ | If override is allowed, this command line parameter overrides the Asset Group specified in the Mass Deployment Wizard. | | JC_SESSION_POLICY= | \ | If override is allowed, this command line parameter sets the Jump Client's session policy that controls the permission policy during a session. | | JC_JUMP_POLICY= | \ | If override is allowed, this command line parameter sets the Asset Policy that controls how users are allowed to connect to the Jump Client. | | JC_TAG= | \ | If override is allowed, this command line parameter sets the Jump Client's tag. | | JC_COMMENTS= | \ | If override is allowed, this command line parameter sets the Jump Client's comments. | | JC_MAX_OFFLINE_MINUTES= | \ | If override is allowed, this command line parameter sets the number of minutes the Jump Client can be offline before being considered lost. | | JC_EPHEMERAL=1 | | If override is allowed on Maximum Offline Minutes, this command line parameter sets the Jump Client to ephemeral mode, marking it as uninstalled if it goes offline for more than 5 minutes. This is the same as setting **--jc-max-offline-minutes 5**. | | ONLINE_INSTALL=1 | | Set the Jump Client to verify online status after installation. This is useful for ensuring that the client is properly connected to the network and can communicate with the server. | | START_SERVICES="" | | Prevents the installer from starting services after installation. Useful in IT scenarios where post-install service startup should be skipped. | > ℹ️ > > When deploying an MSI installer on Windows using the msiexec command: > > - The installation directory may be specified by passing a variable: **INSTALLDIR=\** > - The **KEY_INFO=** is optional as it is built into the filename. > - If you specify **ONLINE_INSTALL=1**, the installation fails if it cannot immediately reach the appliance. The default is blank. > - A silent installation can be done by specifying **/quiet** to the msiexec command. > - All of the --jc… parameters listed above may be specified as variables by: > 1. Removing leading dashes (-) > 2. Converting remaining dashes to underscores (\_) > 3. Assigning a value using an equals sign (=) > ✅ Example > > ``` > msiexec /i sra-scc-win32.msi jc_jump_group=jumpgroup:general jc_tag=servers > ``` > ℹ️ > > Normally, when msiexec runs, no messages display in the command line interface. To wait for the installation to complete and to check for any errors, you can set up your command like this: > > ``` > $ start /wait msiexec /qn /i sra-pin-21fce94dee1940e.msi ONLINE_INSTALL=1 > $ echo %ERRORLEVEL% > ``` > > The error output will be either **0** to indicate success or a number indicating an error. For more information about error codes, see . ### Modify Windows proxy information In some cases, the proxy settings of an existing Windows Jump Client must be manually modified to accommodate changes in the proxy environment. The Jump Client has built-in logic to automatically detect updated proxy information within a 24-hour period. However, if the proxy enforces authentication, then the end-user is prompted to enter authentication credentials. If the system is unattended, then credentials and/or other proxy information may need to be manually entered. The following steps guide you through manually modifying proxy-related sections of the **settings.ini** file used by the Jump Client. > ℹ️ > > If a large number of systems must be manually modified, the process can be automated. You can develop a script to do this, or contact [BeyondTrust Technical Support](http://www.beyondtrust.com/support) to engage the BeyondTrust Professional Services group. To manually modify the proxy information for a pre-existing Jump Client on a Windows system: 1. Go to **C:\\ProgramData\\sra-scc-**, where **** is the Jump Client's unique ID. 2. Locate and edit the **settings.ini** file. 3. Within **settings.ini**, locate the proxy-related section, titled **\[Proxy\]**. An example existing proxy section is shown below. ``` [Proxy] version=2 detect_failed=0 [Proxy\access.example.com:443\LastGood] Proxy=DIRECT [Proxy\access.example.com:443\Detected\1] Proxy=DIRECT ``` 4. Remove all of the settings within the **\[Proxy\]** section and replace them with the settings as follow. Replace all \ text with the appropriate information. ``` [Proxy] version=1 ProxyUser= ProxyPass= [Proxy\Manual] ProxyMethod= ProxyHost= ProxyPort= ``` An example of a manually modified section is below. ``` [Proxy] version=1 ProxyUser=myDomain\proxyUser ProxyPass=MyPassword [Proxy\Manual] ProxyMethod=200 ProxyHost=myproxyserver.example.com ProxyPort=8443 ``` 5. Save and close the **settings.ini** file. 6. Either reboot the system or stop/start the BeyondTrust Jump Client service for the new information to apply. 7. The Jump Client nows use the manually defined proxy information. > ℹ️ > > After making the above changes to the **settings.ini** file, the defined username and password which were entered in plain text will be hashed into an unreadable format. Jump Clients support Windows Server Core environments. You can install a Jump Client on a Core machine using a curl command from /login or by copying the MSI installer manually. Once installed, users connect to the endpoint through a remote shell session. Windows Server Core has no GUI; sessions open at a command prompt. ### Before you begin - Privileged Remote Access is licensed and the appliance is configured. - You have administrator access to the /login interface. - The target Windows Server Core machine has network access to the BeyondTrust appliance. - You have local administrator rights on the target machine. ### Supported platforms: - Windows Server 2019 Core - Windows Server 2022 Core - Windows Server Core deployed in Azure ### Why this is important Windows Server Core is Microsoft's default server recommendation since 2019 and is widely used in security-sensitive environments due to its reduced attack surface and minimal footprint. Official Jump Client support for Core means organizations running headless servers (on-premises, in Azure, domain-joined, or in workgroup configurations) can include BeyondTrust in their Zero Trust and security-first architectures with full confidence. ### Steps summary | Step | Action | | :--- | :-------------------------------------------- | | 1 | Generate the Jump Client installer in /login | | 2 | Install the Jump Client on the Core machine | | 3 | Verify the Jump Client appears in the console | | 4 | Connect to the endpoint | ### Steps #### Step 1: Generate the Jump Client installer 1. Use a Chromium-based browser to sign in to your Privileged Remote Access URL. This URL is provided in the BeyondTrust welcome email and includes your site URL followed by **\/login**. 2. From the left menu, click **Asset Management**. The **Jump Clients** page opens and displays by default. 3. Click the **Add **at the top of the screen to create a Jump Client Installer List. Configure the Jump Client settings, and then click **Create**. 4. Copy the curl command displayed after the Jump Client is created. You use this to install the client directly on the Core machine. #### Strep 2: Install the Jump Client Choose one of the following installation methods. **Method 1: curl command (recommended)** 1. Sign in to the Windows Server Core machine. 2. At the command prompt, paste and run the curl command copied from /login. The Jump Client installs silently. **Method 2: MSI installer via shared drive** 1. From /login, download the Jump Client MSI installer. 2. Copy the MSI to a network share that the Core machine can access. 3. On the Core machine, map the shared drive or access the share directly, then copy the MSI to a local directory. 4. Run the following command to install silently: ```Text Run this command: msiexec /i .msi /quiet ``` #### Verify and connect 1. In the Access Console, confirm that the new Jump Client appears in the expected Jump Group. 2. Right-select the Jump Client and select Jump to start a session. The session opens at a command prompt. Windows Server Core does not have a graphical desktop. 3. From the command prompt, you can access the Server Configuration menu or run commands directly. To open a full command-line interface from the Server Configuration menu, select option 15 (or the equivalent Command Line option on your Core version). ### Supported features The following features are supported in Jump Client sessions on Windows Server Core: - Remote shell sessions - File transfer - Session logging and recording - Credential injection - Client auto-update ### Additional information - **Footprint:** The Jump Client requires less than 100 MB of disk space and has no GUI service dependencies. - **PowerShell:** The Jump Client is compatible with PowerShell-based management and scripting. - **Encryption: **TLS 1.2 and TLS 1.3 are supported. - **Deployment scenarios:** Domain-joined and workgroup configurations are supported, both on-premises and in Azure. ### Verify the results Confirm that the Jump Client appears in the Access Console and that a user can start a session and reach a command prompt on the Core machine. Verify that file transfer and credential injection work as expected within the session. ### Avoid deploying duplicates When mass-deploying the SRA Jump Client MSI with tools such as SCCM or Altiris, it is important to avoid installing duplicate clients, because this can cause multiple deployment failures. BeyondTrust does not provide any utilities for deploying clients, but there are some basic methodologies you can use to script a deployment system that will only install Jump Clients on systems that do not have one installed already. These methods depend on whether you already have Jump Clients installed. If you have already installed Jump Clients, your script can be modified to prevent duplicates. If you have installed Jump Clients, you can use the INSTALLDIR.MSI variable or a custom file as described below. When you use INSTALLDIR, the MSI installation package itself automatically aborts if it finds the directory you specify already exists. If you choose the custom file option, you must script the install to check for this file prior to running the MSI installation package. #### Prevent additional duplicates If your deployment tool has already deployed duplicate clients, edit your script so that the tool aborts installation if the target system matches either of these conditions: - The system has any **sra-scc.exe** processes running. - The system has any **DisplayName** registry entries matching BeyondTrust Privileged Remote Access _Jump Client \[support.example.org\]_, where _support.example.com_ matches the hostname of your SRA appliance. #### Prevent duplicates before deployment If your deployment tool has not yet deployed any clients, you can script the tool to use the INSTALLDIR variable or deploy a custom file during the install process. ##### Use INSTALLDIR Follow these steps to use the INSTALLDIR variable: 1. From the /login administrative interface, go to **Asset Management > Jump Clients**. 2. At the top of the **Jump Client Installer List**, click **Add**. 3. Enter the appropriate mass deployment wizard parameters. 4. Click **Create**. 5. Select **Windows (x64) MSI**, copy the string after _KEY\_INFO=_, and then click **Download/Install**. 6. Load the downloaded MSI into your deployment tool and script the tool to install it using the following command: _msiexec /i sra-scc-win64.msi KEY\_INFO=\ INSTALLDIR= /quiet_ where _\_ is the _KEY\_INFO_ string you copied earlier and __ is the install directory of your choice. 7. Configure the deployment tool to abort installation if it finds the install directory you have chosen is already present. ##### Use a custom file You have the option of deploying a custom file during installation and automatically aborting subsequent duplicate installation if this file is found. To do this: 1. Save a small text file with a descriptive title such as _PRAJumpClient.txt_ to a shared network location accessible from all systems on which Jump Clients will be deployed. 2. Follow the above steps for using INSTALLDIR to create and download an MSI installation file. 3. Configure the script to abort if the _PRAJumpClient.txt_ file already exists, or copy it to the local system and install the MSI file if the text file does not exist. ### Manage deployment rate It is important to consider rate of deployment if mass deploying on a large scale. A large number of simultaneous client installations can cause network traffic delays. Depending on the deployment method used, the granular control allowed may vary. We recommend deploying no more than 60 clients per minute to avoid installation failures and degraded performance. For reference, 60 clients per minute equates to: - 1 client install per second - 60 client installs per minute - 3,600 client installs per hour Performance impact may vary with environmental factors, usage patterns, and appliance resources. BeyondTrust recommends starting mass deployment conservatively with smaller scale pushes at slower rates to confirm acceptable performance before gradually scaling up the number and rate of deployment. ## Install on Linux There are several changes on how you download and install Jump Clients on Linux. 1. The biggest change is how you download the Linux installer. The headless and desktop version are now combined as one. The Platform dialog box for the installer displays as **Linux (64)** instead of **Linux (64)** and **Linux (64) Headless**. 2. Headless can now be deployed in service and user mode. In previous versions, headless was only available in user mode. 3. The are several new parameters for the command line. They are the following: - Scope - Startup - Headless - Online-install - Session-user > ℹ️ > > The **--silent** parameter has been removed and no longer valid. You can override certain installation parameters specific to your needs. These parameters can be specified using a systems administration tool or the command line interface. When you mark specific installation options for override during installation, you can use the following optional parameters to modify the Jump Client installer for individual installations. > ℹ️ > > The **-jc attribute** parameters are also available and work on a Windows-based system. [block:parameters] { "data": { "h-0": "Command line parameter", "h-1": "Value", "h-2": "Description", "0-0": "**--scope**", "0-1": "\\", "0-2": "", "1-0": "**--startup**", "1-1": "\\.", "1-2": "
  • **systemd**: A systemd service is created automatically.
  • **xdg**: An XDG autostart file is created to start the service when the user logs into the graphical shell.
  • **none**: The user must arrange for **init-script start** to be run.
  • **auto (default)**: If scope is **system** and **systemctl** is found, then startup will be **systemd**. If scope is **user**, then startup will be **xdg**. Else, startup will be **none**.
", "2-0": "**--headless**", "2-1": "", "2-2": "Does not involve any functionality requiring a graphical session.", "3-0": "**\\--install-dir**", "3-1": "\\", "3-2": "Specifies a new writable directory under which to install the Jump Client. This is supported only on Windows and Linux. When defining a custom install directory, ensure that the directory you are creating does not already exist and is in a location that can be written to.", "4-0": "**\\--jc-key-info**", "4-1": "\\", "4-2": "Specifies a keyinfo parameter required to install the generic Jump Client installer.", "5-0": "**\\-jc-name**", "5-1": "\\", "5-2": "If override is allowed, this command line parameter sets the Jump Client's name.", "6-0": "**\\--jc-jump-group**\t", "6-1": "user: jumpgroup:", "6-2": "If override is allowed, this command line parameter overrides the Asset Group specified in the Mass Deployment Wizard.", "7-0": "**\\--jc-session-policy**\t", "7-1": "", "7-2": "If override is allowed, this command line parameter sets the Jump Client's session policy that controls the permission policy during a session.", "8-0": "**\\--jc-jump-policy**\t", "8-1": "", "8-2": "If override is allowed, this command line parameter sets the Asset Policy that controls how users are allowed to connect to the Jump Client.", "9-0": "**\\--jc-tag**", "9-1": "", "9-2": "If override is allowed, this command line parameter sets the Jump Client's tag.", "10-0": "**\\--jc-comments**\t\t", "10-1": "\\", "10-2": "If override is allowed, this command line parameter sets the Jump Client's comments.", "11-0": "**\\--jc-max-offline-minutes**\t\t", "11-1": "", "11-2": "If override is allowed, this command line parameter sets the number of minutes the Jump Client can be offline before being considered lost.", "12-0": "**\\--jc-ephemeral**\t", "12-1": "None", "12-2": "If override is allowed on Maximum Offline Minutes, this command line parameter sets the Jump Client to ephemeral mode, marking it as uninstalled if it goes offline for more than 5 minutes. This is the same as setting --jc-max-offline-minutes 5.", "13-0": "**--online-install**", "13-1": "", "13-2": "The installer only completes if it can successfully connect to the server during installation. If a connection cannot be established, the installation fails immediately.", "14-0": "**--session-user**", "14-1": "\\", "14-2": "Causes sessions to run as the specified user. This setting is only applicable if **--scope system** and -**-headless** are specified. \n \n
ℹ️If you don't specify this parameter, you get a root based headless session every time you perform a Jump.
", "15-0": "**--help**", "15-1": "", "15-2": "Displays the argument help to the user." }, "cols": 3, "rows": 16, "align": [ "left", "left", "left" ] } [/block] ### Wayland support Wayland is a modern display server protocol used in Linux-based operating systems. It serves as a replacement for the older X11 (X Window System), aiming to provide a simpler, more efficient, and more secure way for graphical applications to communicate with the display hardware. The Wayland to X11 Video Bridge is required for the Jump Client to work. It is preinstalled with Wayland on most Linux distributions. This feature offers foundational capabilities, with more enhancements planned in upcoming releases. #### Supported capabilities - Mouse and keyboard support - Ability to screen share - Ubuntu 24.04 and RHEL 10 support - Support of English keyboards #### Current limitations - After installing a Jump Client, it is recommended to log out at least once to fully reinitialize the display manager. - Jump Client thumbnails are not currently supported on Wayland. - Team Monitoring is not currently supported. If you try to use a Jump Client, it should connect correctly. However, if you do need to disable Wayland support for troubleshooting purpose, you can disable Wayland in the **custom.conf** file by following these steps: 1. Open a command line terminal, and then edit the **/etc/gdm3/custom.conf** file to set **WaylandEnable=false**. 2. Type the following syntax: ``` WaylandEnable=false ``` 3. Restart the computer. ### Install a Linux Jump Client in service mode > ℹ️ > > To install a Jump Client in service mode on a Linux system, the Jump Client installer must be run by root, but the Jump Client service should not be run under the root user context. A service mode Jump Client allows the user to start a session even if no remote user is logged on, as well as to log off the current remote user and log on with different credentials. A Linux Jump Client installed in user mode cannot be elevated within a session. Run the installer as the root user using the **sudo** command: ``` sudo sh ./Downloads/sra-pin-[uid].bin ``` Linux Jump Clients can be installed in service mode. The status of any Jump Client is shown in the info panel that appears when a Jump Client is highlighted in the representative console’s list of Jump Clients. If a Jump Client shows the **Install Mode** as **Service**, it is installed as a service; otherwise, this field reads **User**, indicating it is installed in single-user context. A service-mode Jump Client allows the user to start a session even if no remote user is logged on, as well as to log off the current remote user and log on with different credentials. A Linux Jump Client installed in user mode cannot do this, nor can it be elevated to service mode within a session. To install a Jump Client in service mode on a Linux system, the Jump Client installer must be by run by root. This causes the Jump Client to run as a system service. The process for doing this varies slightly depending on the distribution of Linux being used, but what follows is typical. 1. Sign in to the **/login** admin web interface of the BeyondTrust site and download a Jump Client installer for Linux from the **Asset Management > Jump Clients** tab. 2. Execute the installation file as the root user using the **sudo** command: ``` sudo sh ./Downloads/sra-pin-[uid].bin ``` Once the installation is complete, a new entry appears in the list of available Jump Clients displayed in the representative console. To test whether the Jump Client is installed as a service or not, you can connect to the client and log out the active user. If you can still control the screen after logging out, this proves the client is running as a service. > ℹ️ > > By default, Jump Clients installed in service mode are found in the **/opt/beyondtrust/sra-pin-\*** folder. ### Uninstall a Jump Client installed on a headless Linux system To uninstall a Jump Client, remove it from the representative console. - If the client is not connected when it is removed from the console, the files are removed the next time the client authorizes with the server. - Manual changes made for service mode Jump Client or headless Jump Client to start on boot are not removed. Jump Clients can be removed from a device by using a script: ```Text Installed in user mode /install/folder/uninstall ``` ```Text Installed in system mode sudo installfolder/uninstall ``` This leaves an entry in the representative console interface. The entry is automatically marked as **uninstalled** or **deleted**, depending on your Jump Client settings. Manual changes made for service mode Jump Client or headless Jump Client to start on boot are not removed by the script. > ℹ️ > > For information about Jump Client settings, see [Jump Client settings](jump-client-guide#jump-client-settings). ### Install a Jump Client on a headless Linux system To install a Jump Client on a remote Linux system with no graphical user interface, be sure you have downloaded the Linux Jump Client installer, and then follow these additional steps: 1. Using your preferred method, transfer the Jump Client installer file to the headless Linux system you wish to access. 2. Once the installer file is on the remote system, use a command interface to install the file and specify any desired parameters, but specifically include the **-–headless** option. See the table above for the various additional command line options, including the **–-scope** parameter to select system or user mode. 3. If the headless Jump Client is installed with system scope, then the service will run as root and started sessions will provide the remote user root access. If root access is not desired, then specify the **\--session-user** argument. ### Screen sharing on a Headless Client As of v25.3, you can screen share on a headless pinned client if X11 is present. **Environmental requirements:** - The launched headless SCC must be informed of the appropriate $DISPLAY value. - If necessary, xauth must permit connections from the user account running the session to the X server user. To meet the requirements above, administrators must have a deeper understanding of their system and perform some extra hands-on steps when installing. Administrators have several options for deploying the Jump Client in these environments. Three example approaches are outlined below. These examples help administrators identify the steps that may apply to their specific system. #### Option 1: Run Everything as root This option is the simplest to install and grants the most system rights to the remote user. Create a script: session-wrapper.sh: ``` #!/bin/bash # This script will run as root. # Here it may be necessary to authorize the session process to connect to the X server # xhost / xauth ... export DISPLAY=:0 export SHELL=/bin/bash exec "$@" ``` Install the Jump Client: 1. Obtain a root shell. 2. Transfer the sra-pin-xxx.bin installer to the system. 3. mkdir /opt/beyondtrust 4. Place session-wrapper.sh in /opt/beyondtrust. 5. chmod +x /opt/beyondtrust/session-wrapper.sh 6. Run: ``` sh "sra-pin-xxx.bin" --headless --session-wrapper /opt/beyondtrust/session-wrapper.sh ``` This automatically starts the Jump Client service at boot. Sessions give root access to the remote user: - Screen Sharing is available. - Remote Shell processes run as root. - File Transfer to and from the system is not limited by file permissions (beyond root’s inherent access). #### Option 2: Install as root, Run Sessions as a user, sessionuser This option is also simple to install, but limits the remote user to the sessionuser account. The administrator must ensure at system start that future support processes running as sessionuser are authorized to connect to the X server or by setting an appropriate $XAUTHORITY value. Create a script - session-wrapper.sh: ``` #!/bin/bash export DISPLAY=:0 # adjust appropriately exec "$@" ``` Install the Jump Client: 1. Obtain a root shell. 2. Transfer the sra-pin-xxx.bin installer to the system. 3. mkdir /opt/beyondtrust 4. Place session-wrapper.sh in /opt/beyondtrust. 5. chmod +x /opt/beyondtrust/session-wrapper.sh 6. Run: ``` sh "sra-pin-xxx.bin" --headless --session-wrapper /opt/beyondtrust/session-wrapper.sh --session-user sessionuser ``` This automatically starts the Jump Client service at boot. Sessions give sessionuser access to the remote user: - Screen Sharing is available. - Remote Shell processes runs as sessionuser. - File Transfer to and from the system is limited to the access rights of sessionuser. #### Option 3: Install Everything as a user, sessionuser This option is the most hands‑on to install, and does not grant BeyondTrust root permissions at any point. Install the Jump Client: 1. Obtain a shell as sessionuser. 2. Transfer the sra-pin-xxx.bin installer to the system. 3. Run: ``` sh "sra-pin-xxx.bin" --scope user --headless ``` 4. Make note of the location of the init-script reported at the end of the installation. When the Jump Client is started (e.g. at boot or user-login), the administrator must: - Ensure the $DISPLAY and, if necessary, $XAUTHORITY variables are exported in the process that launches the service. Regarding X authorization, in many distributions, a /home/sessionuser/.Xauthority file is already configured to authorize connections to the X server, which is used by default. - Execute init-script start to start the service. The full path to this script is provided by the installer when installation completes. Sessions give sessionuser access to the remote user: - Screen Sharing is available. - Remote Shell processes runs as sessionuser. - File Transfer to and from the system is limited to the access rights of sessionuser. > ℹ️ > > - In any of the scenarios above, --install-dir \ can be used to control where the software is installed. > - If a system is rebooted during a session, the session does not automatically resume. The remote user needs to initiate a new connection. Any session-wrapper.sh script above can be used to remove leftover session folders if the system is rebooted while a session is in progress. ## Install on Mac systems Jump Clients are deployed on macOS using a **.pkg** installer. Only one **.pkg** file can be installed, and only system mode Jump Clients are supported. > ℹ️ > > One **.pkg** file can be installed from each distinct RS or PRA deployment. You can install the **.pkg** file with either a generic or a non-generic installer. Jump Client installations on macOS can be customized using configuration profiles (**.mobileconfig**) that are deployed _before_ installing the **.pkg** file. ### Generic installer The generic installer requires a .**mobileconfig** file. Without this file, the Jump Client cannot register with your BeyondTrust environment. At a minimum, the **.mobileconfig** must include **key_info**. You can customize the installation with additional settings, such as comments or a Jump Group, by including those in the same **.mobileconfig** file. > ℹ️ > > For more information, see [Download the Generic Jump Client Installer](#download-the-generic-jump-client-installer) and [Deploy the configuration profile](#deploy-the-configuration-profile). ### Non-generic installer The non-generic installer does not require a **.mobileconfig** file. It contains the necessary connection information to register the Jump Client without any additional configuration. However, if you want to customize the installation with additional settings, such as comments or a Jump Group, you must provide a **.mobileconfig** file. This file is the only way to specify those settings. You can also include **key_info** if including a **.mobileconfig** file. It is used if present, though this is not necessary or recommended when using the non-generic installer. ### Parameters [block:parameters] { "data": { "h-0": "Command line parameter", "h-1": "Type", "h-2": "Value ", "h-3": "Description", "0-0": "key_info", "0-1": "string", "0-2": "", "0-3": "Specifies a keyinfo parameter required to install the generic Jump Client installer.", "1-0": "online_install", "1-1": "boolean", "1-2": "", "1-3": "Set the Jump Client to verify online status after installation. This is useful for ensuring that the client is properly connected to the network and can communicate with the server.", "2-0": "name", "2-1": "string", "2-2": "\\", "2-3": "If override is allowed, this command line parameter sets the Jump Client's name.", "3-0": "jump_group", "3-1": "string", "3-2": "user: \nOR \njumpgroup:", "3-3": "If override is allowed, this command line parameter overrides the Asset Group given above.", "4-0": "public_site_address", "4-1": "string", "4-2": "", "4-3": "If override is allowed, this command line parameter associates the Jump Client with the public portal which has the given hostname as a site address. If no public portal has the given hostname as a site address, then the Jump Client will revert to using the default public site.", "5-0": "session_policy_present", "5-1": "string", "5-2": "", "5-3": "If override is allowed, this command line parameter sets the Jump Client's session policy that controls the permission policy during a support session if the customer is present at the console.", "6-0": "session_policy_not_present", "6-1": "string", "6-2": "", "6-3": "If override is allowed, this command line parameter sets the Jump Client's session policy that controls the permission policy during a support session if the customer is not present at the console.", "7-0": "support_button_profile", "7-1": "string", "7-2": "", "7-3": "If override is allowed, this command line parameter sets the Jump Client's Support Button profile that controls the configuration of the Support Button created by the Jump Client.", "8-0": "support_button_direct_queue", "8-1": "string", "8-2": "team:", "8-3": "If override is allowed, this command line parameter sets the Jump Client's Support Button direct queue.", "9-0": "jump_policy", "9-1": "string", "9-2": "", "9-3": "If override is allowed, this command line parameter sets the Asset Policy that controls access to the Jump Client.", "10-0": "tag", "10-1": "string", "10-2": "", "10-3": "If override is allowed, this command line parameter sets the Jump Client's tag.", "11-0": "comments", "11-1": "string", "11-2": "\\", "11-3": "If override is allowed, this command line parameter sets the Jump Client's comments.", "12-0": "max_offline_minutes", "12-1": "integer", "12-2": "", "12-3": "If override is allowed, this command line parameter sets the number of minutes the Jump Client can be offline before being considered lost.", "13-0": "ephemeral", "13-1": "boolean", "13-2": "", "13-3": "Set the Jump Client to ephemeral mode. It will be marked as uninstalled if it goes offline for more than 5 minutes. \n \nThis is convenience alias for setting **max_offline_minutes** to **5**. You must be allowed to override Maximum Offline Minutes during installation to use this flag." }, "cols": 4, "rows": 14, "align": [ "left", "left", "left", "left" ] } [/block] ### Download the Generic Jump Client Installer 1. On the Jump Client page, go to the **Generic Jump Client Installer Download** section. 2. Select **macOS** from the **Platforms** dropdown. 3. Copy the **Generic Jump Client installer command** to your clipboard by clicking ![](https://files.readme.io/b0ed247346947995e3d7c3f32612ecc85f1e3a8371b18f64e604a6f5346ad1ad-cloud-copy.png). This is used to install the **.pkg** file. 4. Click **Download**. > ℹ️ > > You must create the configuration profile and deploy it prior to installing the **.pkg** file. ### Deploy the configuration profile 1. Create a .**mobileconfig** file with the required parameters. You can create the file using an app, such as [Apple Configurator for Mac](https://support.apple.com/en-ca/guide/apple-configurator-mac/pmd85719196/mac#:~:text=Table%20of%20Contents,Edit%20a%20configuration%20profile), or you can download and edit an example configuration profile located on the **Jump Clients** tab. Navigate to **Jump Clients > Jump Client Installer Usage > macOS Deployment > Installation Steps** to download a copy of this profile. 2. Deploy the profile by opening the file in Finder. Or you can deploy it via Mobile Device Management (MDM). ### Install the .pkg file 1. At the top of the **Jump Client Installer List** , click **Add**. The **Jump Client Mass Deployment Wizard** page displays. 2. Fill out the fields as required, and then click **Create**. 3. Select **macOS** from the **Platforms** dropdown. 4. Click **Download**. 5. Install the **.pkg** file: ``` - sudo installer -pkg -target / ``` 6. (Optional) Remove the profile after installation: ``` - sudo profiles remove -identifier com.beyondtrust.jumpclient.deploy.bt_example_com ``` The installer files for access consoles and Jump Clients allow you to mass deploy BeyondTrust software to your macOS devices. This guide provides examples of how to mass-deploy BeyondTrust software using generally accepted deployment concepts. Actual deployment steps may vary. ### Set privacy policy preference control Starting with macOS Mojave (10.14), Apple introduced new privacy controls for end users. These controls require that applications be granted permission to access sensitive data or use macOS accessibility features. As an administrator, you can grant these permissions to an MDM-managed Mac using a Privacy Policy Preference Control (PPPC) profile. To ensure proper functionality of the BeyondTrust Privileged Remote Access Customer Client, deploy a PPPC profile targeting the following app bundle: - **Identifier**: com.bomgar.bomgar-scc - **Identifier Type**: Bundle ID - **Code Requirement**: identifier "com.bomgar.bomgar-scc" and anchor apple generic and certificate 1\[field.1.2.840.113635.100.6.2.6\] /\* exists \*/ and certificate leaf\[field.1.2.840.113635.100.6.1.13\] /\* exists \*/ and certificate leaf\[subject.OU\] = B65TM49E24 | Service | Purpose | Allowed | | --------------------------------------- | -------------- | ----------------------------------- | | Accessibility | Screen Sharing | true | | SystemPolicyAllFiles (Full Disk Access) | File Transfer | true | | ScreenCapture (Screen Recording) | Screen Sharing | AllowStandardUserToSetSystemService |
> ℹ️ > > Screen recording can only be configured via MDM to allow a non-admin user to provide consent. IT administrators cannot grant screen recording permissions on behalf of end users. This preference is applicable for systems running macOS Big Sur (11.0) and later. ### Configure managed login items Starting with macOS Ventura 13, Apple introduced a new framework for managing background tasks such as LaunchAgents, LaunchDaemons, and Login Items. BeyondTrust's Jump Client for Privileged Remote Access leverages background tasks to ensure the client is running at all times. Administrators can manage these background tasks using a Managed Login Items payload delivered to managed devices. To ensure proper functionality, deploy a configuration profile targeting the below values: | Rule Type | Rule Value | | --------------- | ---------- | | Label Prefix | Bomgar | | Team Identifier | B65TM49E24 | | Label Prefix | com.bomgar | ### Configure appliance When deploying the Jump Client, there are two prerequisites that must be completed in Privileged Remote Access. - A user account with administrative permission to access the /login interface is required. This user can create Jump Clients only for Asset Groups where they have appropriate permissions. - To ensure that a single Jump Client installer can be used to pin a system to any Asset Group, a service account with **Manage** permissions on all Asset Groups must be created. ### Create a service account user for Jump Client package creation 1. Log in to the Privileged Remote Access user interface. 2. Click **Users & Security**. 3. Click **Add**. 4. Fill in the basic details for the user account. 5. Expand **Account Settings**. 6. Check **Account Never Expires**, if necessary. 7. Expand **Access Permissions**. 8. Ensure **Allowed to access endpoints** is checked. 9. Uncheck all boxes under the **Session Management** and **User-to-User Screen Sharing** areas. 10. Under **Allowed Asset Methods**, ensure: - **Jump Clients** is checked - All other methods are unchecked 11. Under **Asset Roles**, ensure: - **Default** dropdown is set to **Administrator** - **System** dropdown is set to **Administrator** 12. Click **Save**. #### Create a Jump Client installer package 1. Log in to the Privileged Remote Access appliance using the new account created above. 2. Click **Asset Management**. The Jump Client tab displays. 3. Click **Add** to add a new Jump Client Installer. 4. Select a default Asset Group within the **Jump Client Mass Deployment Wizard**. 5. Check **Allow Override During Installation** for all available options. 6. Select your desired validity period from the **This Installer is Valid For** dropdown . 7. Check **Start Customer Client Minimized When Session is Started**, to ensure a completely silent deployment. 8. Click **Create**. 9. From the **Platform** dropdown, select **macOS** (for programmatic installation). 10. Click **Download**. A DMG file downloads. This is later imported into your management platform. > ℹ️ > > Do not rename the downloaded DMG file. ### Deploy manually The BeyondTrust Privileged Remote Access Jump Client installer is delivered as a uniquely generated and named DMG file. This file has the format _sra-scc-\.dmg_. For deployment, the sequence of steps includes: 1. Stage the DMG file in a temporary location. 2. Mount the DMG file. 3. Install the Remote Support Jump Client. 4. Unmount the disk image. 5. Remove the DMG from the temporary location. ### Deploy using JAMF Pro > ℹ️ > > This information is provided for general assistance when using JAMF Pro, however BeyondTrust cannot provide support for third-party products, and their requirements and operations may change. #### Upload package to Jamf software server 1. Log in to your Jamf Software Server (JSS) via a web browser. 2. Click **Computers**. 3. Click **Management Settings**. 4. Click the **Computer Management** tab. 5. Click **Packages**. 6. Click **New**. 7. Fill out a display name, and choose a category (if applicable). 8. Click **Upload** to choose the DMG file. 9. Click **Save**. #### Upload deployment script 10. If necessary, log in to the JSS via a web browser. 11. Click **Computers**. 12. Click **Management Settings**. 13. Click the **Computer Management** tab. 14. Click **Scripts**. 15. Click **New**. 16. Copy and paste this sample deployment script on the **Script** tab (for Privileged Remote Access versions 23.3.1 and later): ``` hdiutil attach /Library/Application\ Support/JAMF/Waiting\ Room/sra-scc-.dmg sudo /Volumes/sra-scc/Open\ To\ Start\ Support\ Session.app/Contents/MacOS/sdcust --silent sleep 15 ``` For Privileged Remote Access versions before 23.3.1, paste this script: ``` hdiutil attach /Library/Application\ Support/JAMF/Waiting\ Room/sra-scc-.dmg sudo /Volumes/sra-scc/Double-Click\ To\ Start\ Support\ Session.app/Contents/MacOS/sdcust --silent sleep 15 ``` 17. Update the file name to match the DMG file downloaded from your appliance. For Privileged Remote Access, this includes updating _bomgar-scc_ to _sra-scc_. 18. Click **Save**. > ℹ️ > > Some networks or environments may have configurations that prevent endpoints from checking for malicious software. This can addressed by adding ``` xattr -d com.apple.quarantine sra-scc-[uid].dmg ``` to the script, or by enabling Stapled Mac Notarization. Administrators should evaluate which approach is more appropriate for their environment. > ℹ️ > > For detailed information on **sdcust** usage, see **Mass Deploy Help** located within the **/login** interface on **Asset Management > Jump Client**. #### Create deployment policy 19. If necessary, log in to the JSS via a web browser. 20. Click **Computers**. 21. Click **Policies**. 22. Click **New**. 23. Provide a policy name, configure desired policy triggers, and ensure **Execution Frequency** is **Once Per Computer**. 24. Click **Packages**, and then click **Configure**. 25. Click **Add** to select the Jump Client package from the list of available packages. 26. Select **Cache** as the action. This makes the packages available in the JAMF downloads folder for use by the deployment script created earlier. 27. Click **Scripts** from the left navigation menu. 28. Click **Add** to select the deployment script created above. 29. Confirm that the **Priority** is set to **After**. 30. Click **Save**. The created policy now runs based on the defined trigger(s) to install the BeyondTrust Jump Client. ## Deploy a Jump Client on a Raspberry Pi To access the File System, Command Shell, and System Info of a remote Raspberry Pi system, you can deploy a Jump Client to that system. 1. From the /login administrative interface, go to **Asset Management > Jump Clients**. 2. From the **Asset Group** dropdown, select whether to pin the Jump Client to your personal list of Assets or to an Asset Group shared by other users. Pinning to your personal list of Assets means that only you can access this remote computer through this Jump Client. Pinning to a shared Asset Group makes this Jump Client available to all members of that Asset Group. 3. You may apply an Asset Policy to this Jump Client. Asset Policies are configured on the **Asset Management > Asset Policies** page and determine the times during which a user can access this Jump Client. An Asset Policy can also send a notification when it is accessed or can require approval to be accessed. If no Asset Policy is applied, this Jump Client can be accessed without restriction. 4. You may choose a **Session Policy** to apply to this Jump Client. A session policy assigned to this Jump Client has the highest priority when setting session permissions. > ℹ️ > > We recommend that you not set a session policy for a headless Jump Client. 5. Adding a **Tag** helps to organize your Jump Clients into categories within the access console. 6. Set the **Connection Type** to **Active** or **Passive** for the Jump Clients being deployed. An active Jump Client maintains a persistent connection to the B Series Appliance, while a passive Jump Client instead listens for connection requests. 7. Add **Comments**, which can be helpful in searching for and identifying remote computers. Note that all Jump Clients deployed via this installer have the same comments set initially, unless you check **Allow Override During Installation** and use the available parameters to modify the installer for individual installations. 8. The installer remains usable only as long as specified by the **This Installer is Valid For** dropdown. Be sure to leave adequate time for installation. If someone should attempt to run the Jump Client installer after this time, installation fails, and a new Jump Client installer must be created. Additionally, if the installer is run within the allotted time but the Jump Client is unable to connect to the B Series Appliance within that time, the Jump Client uninstalls, and a new installer must be deployed. The validity time can be set for anywhere from 10 minutes to 1 year. This time does NOT affect how long the Jump Client remains active. In addition to expiring after the period given by the **This Installer is Valid For** option, Jump Client mass deployment packages invalidate when their B Series Appliance is upgraded. The only exception to this rule is live updates which change the license count or license expiration date. Any other updates, even if they do not change the version number of the B Series Appliance, invalidate the Jump Client installers from before the upgrade. Once a Jump Client has been installed, it remains online and active until it is uninstalled from the local system either by a user from the Asset Management Interface or by an uninstall script. It can also be uninstalled, or extended, from the Jump Client Installer List. A user cannot remove a Jump Client unless the user is given appropriate permissions by their admin from the /login interface. 9. Once you click **Create**, select the **Raspberry Pi OS** option, and then click **Download**. 10. Using your preferred method, push the Jump Client installer file to each headless system you wish to access. 11. Once the installer file is on the remote system, install the file in a location to which you have write permission, using **\--install-dir **. You must have permission to write to this location, and the path must not already exist. Any additional parameters must also be specified at this time, as described below. ``` sh ./sra-scc-{uid}.bin --install-dir /home/pi/ ``` 12. You can also override certain installation parameters specific to your needs. When you mark specific installation options for override during installation, you can use the following optional parameters to modify the Jump Client installer for individual installations. Note that if a parameter is passed on the command line but not marked for override in the /login administrative interface, the installation fails. If the installation fails, view the operating system event log for installation errors. | Command Line Parameter | Value | Description | | ---------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | \--jc-jump-group | user: \
jumpgroup: \ | If override is allowed, this command line parameter overrides the Asset Group specified in the Mass Deployment Wizard. | | \--jc-session-policy | \ | If override is allowed, this command line parameter sets the Jump Client's session policy that controls the permission policy during an access session. | | \--jc-jump-policy | \ | If override is allowed, this command line parameter sets the Asset Policy that controls how users are allowed to connect to the Jump Client. | | \--jc-tag | \ | If override is allowed, this command line parameter sets the Jump Client's tag. | | \--jc-comments | \ | If override is allowed, this command line parameter sets the Jump Client's comments. | 14. After installing the Jump Client, you must start its process. The Jump Client must be started for the first time within the time frame specified by **This Installer Is Valid For**. ``` /home/username/jumpclient/init-script start ``` This init script also accepts the **stop**, **restart**, and **status** arguments. You can use **./init-script status** to make sure the Jump Client is running. 15. You must also arrange for **init-script start** to run at boot in order for the Jump Client to remain available whenever the system restarts. An example **system.d** service displays once the Jump Client is installed. Copy this information and create the new service for the Jump Client, **filename.service** (where _filename_ is any name you choose), following these steps: - **cd /etc/systemd/system** - **vi filename.service** - Paste copied information - run **chmod 777 filename.service** - Reload the **systemctl** daemon - Enable and start the service file 16. If you wish to uninstall the Jump Client, you must run its uninstall script. ``` /home/pi//uninstall ``` > ℹ️ > > Separately and in addition to running the uninstall script, you must remove the Jump Client via the access console. Otherwise, the Jump Client remains in the access console, though it is not accessible. Relatedly, removing the Jump Client via the access console only prevents it from being accessed but leaves the Jump Client files on the system. ## Assign a Jump Client to multiple Asset Groups at installation When deploying Jump Clients, you can assign each client to multiple Asset Groups simultaneously by passing a comma-separated list of group identifiers to the *JC\_JUMP\_GROUP* installer parameter. This parameter accepts up to 10 Asset Groups. The Jump Client registers in all specified groups as soon as it connects. No post-installation steps, API calls, or custom scripts are required. This is useful when a device needs to be accessible from more than one group, e.g. a shared group for broad support visibility and one or more scoped groups for access segmentation by team, vendor, or organizational unit. ### Syntax Provide a comma-separated list of Asset Group identifiers as the value of *JC\_JUMP\_GROUP*: ```Text Example: msiexec /i "JumpClient.msi" /quiet JC_JUMP_GROUP="jumpgroup:GroupA,jumpgroup:GroupB,jumpgroup:GroupC" ``` A single group value works exactly as before: ```Text Example: msiexec /i "JumpClient.msi" /quiet JC_JUMP_GROUP="jumpgroup:GroupA" ``` ### Supported Deployment Methods Multi-group assignment works with all standard Jump Client deployment methods: * Silent MSI installs (*/quiet*, */qn*) * Scripted deployments * Group Policy Object (GPO) * Endpoint management platforms such as Microsoft Endpoint Configuration Manager (MECM), Intune, and Jamf No additional configuration or post-install steps are needed when using any of these methods. ### Platform Support The multi-group parameter syntax is supported across all Jump Client installer types: * **Windows** - MSI installer * **macOS** - pkg installer * **Linux** - installer package ### Behavior When a Jump Client is installed with multiple group identifiers: * It registers in all specified groups simultaneously. * Sessions can be initiated from any of the assigned groups. * Per-group access policies apply correctly for each group. #### Invalid or inaccessible group identifiers If one or more of the specified Asset Groups does not exist or is inaccessible at the time of registration, the installer either: * If one or more of the specified Asset Groups does not exist or is inaccessible at the time of registration, the installer skips the invalid Asset Group and continue with the deployment. ### Backward Compatibility This change is fully backward-compatible. Jump Clients installed with a single group identifier behave exactly as they do today. No changes to existing deployments are required.