Appearance
Zero-Touch Client Deployment
The Turbo Update Service MSI installs the Turbo Client, configures it, and enrolls the device from properties you pass to msiexec. Your deployment tool runs one install and nothing further is required: no configuration script and no sentinel file to detect one.
batch
msiexec /i TurboUpdateService.msi /qn ^
HUB_URL="https://hub.company.com" ^
ENROLLMENT_TOKEN="<token>" ^
CLIENT_CONFIG="--domain=https://hub.company.com --image-path=allusers" ^
INSTALL_CLIENT=1| Property | Description |
|---|---|
HUB_URL | Base URL of your Turbo Hub, used to check for Turbo Client updates |
ENROLLMENT_TOKEN | The token the device enrolls with. Create one in the Administration site; see Creating an Enrollment Token |
CLIENT_CONFIG | Any arguments accepted by turbo config, applied for all users in the order given |
INSTALL_CLIENT | 1 has the update service install the channel's current Turbo Client when the device has none. Leave it unset when your deployment installs the Turbo Client MSI itself |
UPDATE_CHECK_PERIOD_MINUTES | Optional. How often the device checks for Turbo Client updates |
HUB_URL and --domain are separate settings and both are needed: the first tells the update service where to fetch client updates from, the second tells the client which Hub to use.
Each CLIENT_CONFIG argument is applied on its own, so write settings in the --flag=value form. A value separated by a space is read as a second setting and will not take effect.
Once the Turbo Client is installed, the device applies each CLIENT_CONFIG argument for all users and then redeems ENROLLMENT_TOKEN: it generates a key that the operating system will not let it export, and the server registers the key as a device of the token's deployment. A machine the deployment already has under the same name, such as one re-imaged, keeps its device and gets the new key. Everything runs in the background within a minute, and retries on its own if the Hub is unreachable at the time. From then on the device signs in with its key, as the deployment's service account, and keeps the system images xvm and base current by itself.
Enrollment requires HTTPS: the server refuses to redeem a token sent over plain HTTP. The token and CLIENT_CONFIG are kept out of the installer log and stored in a registry key only SYSTEM and Administrators can read.
Creating an Enrollment Token
- In the Administration site, open Identity → Deployments, and open the deployment the devices belong to, or select New Deployment to create one. A deployment names the service account its devices act as, whose permissions decide what they can reach, and whether Windows accounts on its devices with no Turbo sign-in run applications as its guests.
- Under Enrollment Tokens, select New Enrollment Token. Name it for the tool or site that installs Turbo, and choose how many machines it may enroll and how long it works.
- Copy the token. It is shown only once; if it is lost, create another.
A token can only enroll devices into its deployment, and each enrolled device appears in the Administration site under Identity → Devices and in ts devices, where you can disable or remove it on its own. Revoke a token on its deployment's page to stop it enrolling more devices.
Rotating or correcting the token
Deploy the MSI again with the new values. The device notices the change and enrolls again within a minute, without a reboot or a service restart. This is also how you recover from a token that was mistyped.
Client Updates
The update service keeps the Turbo Client current from your Hub. Installing a client update closes running Turbo applications and the Turbo Launcher, deploys the new version, and restarts the client in each signed-in session. Interactive installs ask for confirmation first, and the Turbo Launcher warns users that installing closes their Turbo applications, both before they choose Install now and ahead of a mandatory update deadline. An update applied automatically at a deadline closes applications without further prompting, so set deadlines with your users' working hours in mind. No script needs to stop or restart Turbo processes around an upgrade.
If a process cannot be closed, the installer still completes and returns exit code 3010, the standard soft-reboot request, which deployment tools handle with their usual reboot behavior.