> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Install macOS Clients

> Install the Syteca macOS Client locally from the command line using the SytecaMacOSClientuniversal.tar.gz installation package. Covers standard and hidden Client variants, Multi-Tenant tenant keys, and the Accessibility and Screen Recording permission grants required for correct Client operation.

## Two macOS Client variants, one installation script

The Syteca macOS Client is installed locally from the command line on each macOS endpoint. Two Client variants exist and are installed with the same procedure:

* **Standard macOS Client** installs the **Syteca Session Client** application, visible to the user. Used in most deployments.
* **macOS Hidden Client** installs the **System Analysis** application, without visible UI indicators. Used when monitoring must stay out of sight. See [macOS Hidden Client](/docs/administration/clients/macos-hidden) for the scope and boundaries of this variant.

The choice between variants happens when downloading the installation package, not during install. The installation procedure below is the same for both.

<Info>
  **Beyond local command-line installation, this page also references mass deployment tools:**

  Remote mass deployment on macOS is supported via mobile device management (MDM) platforms. Two of the most common MDM platforms have their own guides in the source documentation. Those procedures are not yet migrated to Mintlify and will be added in future batches.
</Info>

## Prerequisites

Before starting a macOS Client installation:

1. Verify the target Mac meets [macOS Client system requirements](/docs/get-started/system-requirements).
2. Download the appropriate installation package from the Management Tool:

   * **`SytecaMacOSClientuniversal.tar.gz`** for the standard macOS Client, or
   * **`macos_hidden_agent_universal.tar.gz`** for the hidden macOS Client.

   On the Installation File Download page, optionally set **Settings Type** to a specific [Client group](/docs/administration/clients/client-groups) instead of the default - new Clients installed from this package join that group automatically.
3. Have administrator access to the target Mac and be prepared to grant the **Accessibility** and **Screen Recording** system permissions to the Client application after installation.

## Install the macOS Client from the command line

<Steps>
  <Step title="Copy the installation package to the target Mac">
    Transfer the downloaded `.tar.gz` package to any folder on the target macOS system.

    <Note>
      For the hidden Client, the package is named `macos_hidden_agent_universal.tar.gz` rather than `SytecaMacOSClientuniversal.tar.gz`. The rest of the procedure is identical.
    </Note>
  </Step>

  <Step title="Open the Terminal and navigate to the folder">
    ```bash theme={"system"}
    cd <path_to_folder>
    ```
  </Step>

  <Step title="Unpack the installation package">
    ```bash theme={"system"}
    tar xvfz <installation_package_name>
    ```
  </Step>

  <Step title="Open the EkranClient folder">
    ```bash theme={"system"}
    cd EkranClient
    ```
  </Step>

  <Step title="Run the install.sh script with Application Server parameters">
    Specify the server hostname or IP address, and optionally the port (default is 9447) and tenant key (for Multi-Tenant deployments):

    ```bash theme={"system"}
    sudo ./install.sh -h <server_host_name/IP_address> [-p <port>] [-t <tenant>]
    ```

    | Argument      | Purpose                                                                                  |
    | ------------- | ---------------------------------------------------------------------------------------- |
    | `-h <host>`   | Application Server hostname or IP address. Required.                                     |
    | `-p <port>`   | Application Server port. Optional. Defaults to **9447**.                                 |
    | `-t <tenant>` | Tenant Key for Multi-Tenant deployments. Optional. Omit for the built-in default tenant. |

    <Note>
      Multiple server hostnames or IP addresses can be provided, separated by semicolons, but the list must be enclosed in double quotation marks:

      ```bash theme={"system"}
      sudo ./install.sh -h "server1;server2;server3"
      ```
    </Note>

    <Note>
      If the `EkranClient` folder contains a `settings.ini` file (custom monitoring parameters were configured when downloading the package), run `install.sh` **without any arguments**. The script reads all parameters from `settings.ini`:

      ```bash theme={"system"}
      sudo ./install.sh
      ```
    </Note>

    **For SaaS deployments**, use the load balancer hostname on the Syteca proxy server, and port **443** (custom ports are not allowed):

    ```bash theme={"system"}
    sudo ./install.sh -h <load_balancer_hostname_or_IP> -p 443
    ```
  </Step>

  <Step title="Grant Accessibility and Screen Recording permissions">
    The **Syteca Session Client** application (or **System Analysis** for the hidden Client) needs both the **Accessibility** and **Screen Recording** macOS permissions to function correctly. Without both permissions, screen captures and keystroke recording will not work.

    | macOS version                    | Where to grant permissions                                                                                                                                                                         |
    | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **macOS 12 (Monterey)**          | Open **System Preferences** → **Security & Privacy** → **Privacy** tab. Verify **Syteca Session Client** is toggled on for both **Accessibility** and **Screen Recording**.                        |
    | **macOS 13 (Ventura) or higher** | Open **System Settings** → **Privacy & Security**. Check permissions on the **Accessibility** and **Screen and System Audio Recording** tabs. Verify **Syteca Session Client** is enabled on both. |

    <Note>
      For the macOS Hidden Client, the application name is `System Analysis` rather than `Syteca Session Client`. Look for that name in the Privacy panes instead.
    </Note>
  </Step>

  <Step title="Confirm installation completion">
    After installation and permission grants, the macOS Client appears on the **Client Sessions** page of the Management Tool.
  </Step>
</Steps>

## Remote mass deployment

Both methods below require the standard `SytecaMacOSClientuniversal.tar.gz` installation package (or a custom one containing a `settings.ini` file), downloaded and unpacked into any folder on a macOS machine first.

<Note>
  Using the hidden macOS Client instead of the standard one? Its package is named `macos_hidden_agent_universal.tar.gz` instead.
</Note>

### Remote mass deployment using Jamf Pro

Deploys to Client computers running macOS 12 (Monterey).

<Steps>
  <Step title="Upload the device profile">
    In Jamf Pro, go to **Computers > Configuration Profiles**, click **Upload**, and select `EkranClient/remote deploy/Profiles for Jamf/Ekran System Client Profile v1.0.mobileconfig` from the installation package.

    <Warning>
      **IN SAAS ONLY:** also repeat this step for `EkranClient/remote deploy/SaaS Ekran System Client Root Certificate Profile.mobileconfig`.
    </Warning>
  </Step>

  <Step title="Scope the profile">
    On the **Scope** tab, add the target computers and click **Save**.
  </Step>

  <Step title="Upload the installation package">
    Go to **Settings > Computer Management > Packages**, click **New**, and upload `EkranClient/SytecaClient-<version>.pkg` (or `EkranClient/SytecaHiddenClient-<version>.pkg` for the hidden Client). Click **Save**.
  </Step>

  <Step title="Upload the postinstall script">
    Go to **Settings > Computer Management > Scripts**, click **New**, name it, and on the **Script** tab paste the contents of `EkranClient/remote deploy/postinstall.sh` from the package.

    <Note>
      If the package's `EkranClient` folder contains a `settings.ini` file, use `EkranClient/remote deploy/postinstall_ini_file_support.sh` instead, and paste the `settings.ini` file's contents into the `SETTINGS_INI_FILE_DATA` variable (replacing `DATA`) - then skip the next step.
    </Note>
  </Step>

  <Step title="Set the Application Server address and tenant">
    In the script, replace `X.X.X.X` with the Application Server's hostname or IP address. The default port value `0` maps to port `9447` (customizable).

    <Warning>
      **IN SAAS ONLY:** use the load balancer's hostname or IP address on the Syteca proxy server instead - port `0` maps to `443` and can't be changed.
    </Warning>

    For a specific tenant in Multi-Tenant mode, replace `90807A10-DF80-45EA-A7DE-A550B55F548A` with the tenant key from the **Tenants** page (leave it unchanged to install on the built-in default tenant).
  </Step>

  <Step title="Save the script">
    On the **Options** tab, set **Priority** to **After**, then click **Save**.
  </Step>

  <Step title="Create the deployment policy">
    Go to **Computers > Policies**, click **New**, name it, and under **Trigger** select **Recurring Check-in**.
  </Step>

  <Step title="Attach the package and script">
    Under **Packages**, click **Configure**, then **Add** next to the uploaded package, and set **Action** to **Install**. Under **Scripts**, click **Configure**, then **Add** next to the uploaded script, with **Priority** set to **After**.
  </Step>

  <Step title="Enable dashboard tracking and save">
    Select **Show in Jamf Pro Dashboard**, then save the policy.
  </Step>
</Steps>

Installation begins about 15 minutes after the policy is created. Track progress from the Jamf Pro **Dashboard**, under **Policy Statuses**.

<Frame caption="Tracking Client installation progress in the Jamf Pro Dashboard.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/clients/jamf-pro-policy-statuses.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=c779bbf31acecb282f18518b1fe87fe4" alt="Jamf Pro Dashboard showing Policy Statuses" width="2088" height="2048" data-path="images/administration/clients/jamf-pro-policy-statuses.png" />
</Frame>

### Deploy the root certificate to Keychain Access (SaaS only)

<Warning>
  **SaaS deployments only.** Before [deploying macOS Clients remotely using Workspace ONE UEM](/docs/administration/clients/install-macos#remote-mass-deployment-using-vmware-workspace-one-uem), the root certificate must first be deployed to the Keychain Access application.
</Warning>

<Steps>
  <Step title="Open the Profiles resource">
    In Workspace ONE UEM, click **Resources > Profiles & Baselines > Profile**.
  </Step>

  <Step title="Upload a profile">
    Click **Add > Upload Profile**.
  </Step>

  <Step title="Select the macOS platform">
    Click the **macOS** platform.
  </Step>

  <Step title="Upload the profile file">
    Click **Upload**, then choose the profile file, and click **Save**.
  </Step>

  <Step title="Continue">
    Click **Continue**.
  </Step>

  <Step title="Configure the deployment settings">
    Configure the profile deployment settings, and select the smart group the profile should target under **Smart groups**.
  </Step>

  <Step title="Publish">
    Click **Save and Publish**, then click **Publish**.
  </Step>
</Steps>

Once published, the profile deploys and the root certificate becomes trusted for all users on the targeted devices.

<Frame caption="A published configuration profile with the root certificate trusted for all users.">
  <img src="https://mintcdn.com/syteca/0FlD-vkHsBA1azVX/images/administration/clients/workspace-one-profile-published.png?fit=max&auto=format&n=0FlD-vkHsBA1azVX&q=85&s=854e4cdaf9a8391466403b6403839edb" alt="Workspace ONE UEM profile deployment confirmation" width="759" height="352" data-path="images/administration/clients/workspace-one-profile-published.png" />
</Frame>

### Remote mass deployment using VMware Workspace ONE UEM

Deploys to Client computers running macOS 12 (Monterey), macOS 13 (Ventura), or macOS 14 (Sonoma).

<Warning>
  **IN SAAS ONLY:** [deploy the SaaS configuration profile](/docs/administration/clients/install-macos#deploy-the-root-certificate-to-keychain-access-saas-only) before continuing.
</Warning>

<Note>
  On macOS 13 (Ventura) or later, grant Workspace ONE Full Disk Access first, under **System Settings > Privacy & Security > Full Disk Access (managedsoftwareupdate)** - otherwise the Client can't install.
</Note>

<Steps>
  <Step title="Create a device profile">
    <Tabs>
      <Tab title="macOS 12 (Monterey)">
        Go to **Devices > Profiles & Resources > Profiles**, click **Add > Add Profile**, select **Apple macOS**, then **Device Profile**. Name it and assign the target **Smart Groups** on the **General** page. On **Custom Settings**, click **Configure** and paste the contents of `EkranClient/remote deploy/Profiles for Workspace ONE/Ekran System Client macOS 11.x.xml`. Click **Save and Publish**, then **Publish**.
      </Tab>

      <Tab title="macOS 13 (Ventura) / 14 (Sonoma)">
        Go to **Resources > Profiles & Baselines > Profiles**, click **Add > Add Profile**, select **macOS system**, then **Device Profile**. Name it, and under **Custom Settings** click **Add** twice to paste in both `Ekran System Client macOS 11.x.xml` and `Ekran System Client Login and Background Items Management.xml`. Click **Next**, select a **Smart Group**, and click **Save & Publish**.
      </Tab>
    </Tabs>
  </Step>

  <Step title="Add the Client application">
    Go to **Apps & Books > Applications > Native**, click **Add > Application File**, and upload `SytecaClient.pkg` from the installation package. Click **Continue**.
  </Step>

  <Step title="Generate and upload metadata">
    Install the **Workspace ONE Admin Assistant for macOS** tool, use it to process `SytecaClient.pkg` and produce a `.plist` file, then upload that file to Workspace ONE UEM.
  </Step>

  <Step title="Set the minimum OS version">
    On the **Details** tab, select the oldest macOS version this deployment should support.
  </Step>

  <Step title="Add the Syteca logo (optional)">
    On the **Images** tab, upload the Syteca logo (also available from the Admin Assistant tool).
  </Step>

  <Step title="Add the postinstall script">
    On the **Scripts** tab, paste the contents of `EkranClient/remote deploy/postinstall.sh` into **Post Install Script**.

    <Note>
      If the package's `EkranClient` folder contains a `settings.ini` file, use `EkranClient/remote deploy/postinstall_ini_file_support.sh` instead, and paste the `settings.ini` file's contents into the `SETTINGS_INI_FILE_DATA` variable (replacing `DATA`) - then skip the next step.
    </Note>
  </Step>

  <Step title="Set the Application Server address and tenant">
    Replace `X.X.X.X` with the Application Server's hostname or IP address (default port `0` maps to `9447`, customizable).

    <Warning>
      **IN SAAS ONLY:** use the load balancer's hostname or IP address on the Syteca proxy server instead - port `0` maps to `443` and can't be changed.
    </Warning>

    For a specific tenant in Multi-Tenant mode, replace `90807A10-DF80-45EA-A7DE-A550B55F548A` with the tenant key from the **Tenants** page.
  </Step>

  <Step title="Configure distribution">
    On the **Distribution** tab, name the distribution, choose the target **Assignment Groups**, set the **Deployment Begins** time, and select **Auto** as the **App Delivery Method**.
  </Step>
</Steps>

Track deployment status from **Apps & Books > Native > `<app name>` > Devices**, or from **Devices > List View > `<device name>` > Apps**.

## Related

<CardGroup cols={2}>
  <Card title="macOS Clients" icon="apple" href="/docs/administration/clients/macos">
    How the macOS Client operates, offline behavior, recording frequency, and status reading.
  </Card>

  <Card title="macOS Hidden Client" icon="eye-off" href="/docs/administration/clients/macos-hidden">
    Install, update, and uninstall the hidden macOS Client variant. Also covers detection in the Management Tool.
  </Card>

  <Card title="Install Windows Clients" icon="monitor-down" href="/docs/administration/clients/install-windows">
    Windows Client installation methods for comparison.
  </Card>

  <Card title="Install Linux Clients" icon="terminal" href="/docs/administration/clients/install-linux">
    Linux and SELinux Client installation from the command line.
  </Card>
</CardGroup>