Enrolment token

Require a secret enrolment token before a new computer can join an organization in Lavawall, so a copied installer or organization ID is not enough.

Open Agent keys in your console

Where to find it
Devices › Agent keys
Who can use it
Super Admins of the organization, or of the organization that manages it
For
Administrators of organizations that use the Lavawall agent
Plan
Every plan that includes the Lavawall agent. See pricing

What an enrolment token is

Screenshots of this page are coming soon. The steps below use the labels you see in the console.

An enrolment token is a secret code that belongs to one organization in Lavawall®. When the organization requires it, a new computer can only join that organization if its installer or install command carries the token.

Without a token, anyone who has your installer or your organization’s ID can add a computer to your organization. That computer would then appear in your reports, use your licences and receive your policies. Requiring a token closes that gap: a copied download link is no longer enough.

Computers that are already installed are never affected by the token or by changes to it. It only matters when a computer joins for the first time.

Choose how the token is used

On Download Agents / Add Computers, each organization has one of three settings for the enrolment token:

  • Off: new computers can join with the installer and organization ID alone, as before.
  • Optional: new computers can join with or without the token, but a wrong or revoked token is refused. Use this while you move your install commands and deployment scripts over to the token.
  • Required: new computers can only join with an installer or command that carries the current token.

An organization needs an active token before it can be set to Required.

How to create, show, replace and revoke the token

  1. In the console, go to Devices › Agent keys and choose the Organization.
  2. Under Enrolment token, click Create token and confirm. The token is shown once with a Copy button. Keep it like a password.
  3. To see it again later, click Show token. The page otherwise shows only the last four characters, when it was created and how many times it has been used.
  4. To change it, click Replace token. The previous token stops working for new computers straight away; update your saved install commands and deployment scripts.
  5. To remove it, click Revoke token. A token cannot be revoked while the organization requires it: stop requiring it first, or replace it instead.

When to replace it

  • When someone who knew the token leaves your team or a client relationship ends.
  • If the token may have been shared, posted or saved somewhere it should not be.
  • On a regular schedule that suits your security policy, for example once a year.

How to install with the token

The easiest way is on Download Agents / Add Computers: choose the organization and click Show install commands with the enrolment token. The page shows the exact commands for Windows, Linux and macOS with your organization’s details filled in. In the examples below, replace <token> with your token and <company key> with the company key shown on that page.

Windows

  1. Download and unzip the Windows installer for the organization.
  2. Open PowerShell or a command prompt as an administrator in the folder you unzipped.
  3. Run .\LavawallWin.exe --t=<token>

Linux

  1. Download the Linux installer and make it executable, as shown on the page.
  2. Run sudo ./LavawallLin --c <company key> --t <token>

macOS

  1. Download and unzip the Mac installer.
  2. In Terminal, in the folder with the installer, run ./LavawallMac --c <company key> --t <token>

In Datto RMM, Intune or another deployment tool, add the token to the command your tool runs, the same way. Keep it in the tool’s secure variable or secret storage rather than in plain script text where your tool offers one.

If the token is missing

  • When the organization requires a token and the installer does not have one, the installer asks for it on screen, in the computer’s language, with a 120-second countdown.
  • If nobody enters a valid token before the countdown ends, the installer undoes the changes it made and stops. Nothing is left half installed.
  • Your organization’s administrators get an alert in the console that an installation was abandoned without a token, so you can follow up.
  • Unattended installs finish on their own either way, because every installer prompt has a countdown. Include the token in deployment commands so they succeed the first time.

Who can see and change it

  • Only a Super Admin of the organization, or of the organization that manages it, can create, show, replace or revoke the token, or change whether it is required.
  • The token is never shown in a web address, and it is only displayed when a Super Admin asks for it.
  • Changing the requirement and replacing or revoking the token ask you to confirm first.

What is recorded in the activity log

  • Creating, replacing and revoking the token.
  • Changing whether the token is off, optional or required.
  • Each time a Super Admin shows the token again.
  • Each new computer refused because its token was missing or wrong.

Frequently asked questions

What is an enrolment token in Lavawall?
A secret code for one organization. When the organization requires it, a new computer can only join that organization if its installer or install command carries the token.
Does an enrolment token affect computers that are already installed?
No. It only matters when a computer joins for the first time. Replacing or revoking it never disconnects existing computers.
What happens if I install without the token when it is required?
The installer asks for the token on screen in the computer’s language with a 120-second countdown. If no valid token is entered, it undoes its changes and stops, and your administrators get a console alert.
Why can I not revoke the token?
The organization requires it. Stop requiring it first, or click Replace token to change it.
Where do I find the install commands with the token?
On Download Agents / Add Computers, choose the organization and click Show install commands with the enrolment token.
Is an enrolment token the same as payment card tokenization?
No. It is unrelated to payment cards. It only controls which computers can join an organization in Lavawall.

Still need help?

Search the support centre, or contact our support team and tell us which page you were on:

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.