Skip to content
MoftgateMoftgate Docs
Product guide

Fleet Discovery & Rescue Tool

The Moftgate Fleet Discovery & Rescue Tool finds machines, bulk-installs or removes agents and reconnects the fleet after a server IP or FQDN change.

What Is the Tool#

The Moftgate Fleet Discovery & Rescue Tool solves a specific operational problem: when the Moftgate management server's address changes (for example, moving to a new IP or a new domain name), every previously-installed agent on Windows, Linux, and macOS clients keeps trying to reach the old address and drops offline. Instead of visiting each machine by hand or reinstalling agents, an administrator runs this tool from a single management machine to discover the whole fleet, push the new server address into each agent, remotely restart the Moftgate agent, and verify that everything reconnects.

The tool is aimed at organizations with a sizable fleet (for example, 50+ Windows/Linux/macOS clients) where a manual, machine-by-machine fix would be impractical. It is used by an administrator, run once (or as needed) from one machine on the network - it is not something end users or customers interact with.

A separate standalone desktop app
This is not a page inside the Moftgate platform - it is a separate desktop application for Windows and macOS. Download it below and install it like any other desktop app.
Fleet Tool Installer

This platform is in final verification and will be released soon.

Discovery Engine#

The tool supports two independent discovery modes, chosen from a mode tab at the top of the app:

  • Workgroup / Subnet mode - scans your local network to find machines within a range you specify (e.g. 192.168.1.0/24). Use this when machines are not part of a domain, or when you simply want to scan a specific part of your network.
  • Active Directory / Domain mode - pulls the full list of machines directly from your Active Directory domain, with an optional filter to scope the list to a specific organizational unit. Use this for domain environments where you want a complete, authoritative machine list rather than a network scan.
The Fleet Discovery interface allows administrators to scan local subnets or query Active Directory, displaying reachable endpoints, operating systems, and agent statuses.
Moftgate Fleet Discovery Scanner & Endpoints Table
Close image
You can combine both
Nothing prevents running a subnet scan and a domain lookup in separate passes - useful when part of your fleet is domain-joined and part sits on a workgroup network segment.

Network & Port Requirements#

For the tool to discover and reconfigure target machines, make sure standard Windows remote management and file sharing access is available on your network, and that remote access is enabled for any Linux or macOS machines you want to migrate:

RequirementPurposeEnvironment
Windows remote managementLets the tool connect to and manage Windows machines remotely.Windows / AD / Workgroup
File sharingLets the tool safely update each machine's connection settings.Windows / AD / Workgroup
Domain lookupLets the tool retrieve your machine list from Active Directory.Active Directory
Linux/macOS remote accessLets the tool update settings and restart the agent on Linux and macOS machines.Linux / macOS
Admin credentials are handled locally
Local admin (for a subnet scan) or Domain Admin (for AD mode) credentials are entered directly into the tool and used only to authenticate with each target machine - they are not sent to Moftgate or any external service. Treat the machine running this tool with the same care as any workstation holding administrative credentials, and prefer running it on a trusted, access-controlled management machine.

Bulk Agent Deployment#

Beyond rescuing existing agents, the Fleet Tool works as a bulk agent installer, in the spirit of the remote installation utilities found in enterprise ITSM products. From the same machine list, an administrator can push a fresh agent install (or a clean removal) to dozens of Windows, Linux, and macOS machines in a single run, without touching any of them. It is the recommended way to roll out Moftgate for the first time in environments where visiting every endpoint would take days.

  • One modal, two operations: choose Install to push a fresh agent, or Uninstall to cleanly remove the agent service, the binary, and the configuration from every selected machine.
  • Flexible targeting: targets come from the same discovery table (subnet scan or Active Directory query), and the Import CSV button loads a prepared list with hostname,ip,os,user columns when the inventory lives outside the network.
  • Windows targets are reached over WinRM, with SSH as an automatic fallback when the machine runs OpenSSH Server. The tool prefers the signed MSI package and installs it silently with the SERVERURL, COMPANYID, and NATSURL properties; when only the raw executable is available, it registers and starts the MoftgateAgent Windows service itself.
  • Linux targets receive the agent binary over SSH/SFTP at /usr/local/bin, get a systemd unit written, enabled, and started, and keep their working data under /var/lib/moftgate.
  • macOS targets are installed from the .pkg installer when it is published on the server, and otherwise fall back to a binary install plus a LaunchDaemon.
  • Package delivery is selectable per run: Server Download makes each target pull the package directly from your Moftgate server, while Local Push uploads the package from the machine running the tool, which is useful when targets cannot reach the server yet.
  • Runs are parallel with a bounded concurrency limit. Every target reports its own live status and log lines, and the final report separates successes from failures so Retry Failed only revisits the machines that did not complete.
  1. 1
    Build the target list

    Run a subnet scan or an Active Directory query, or click Import CSV to load a prepared list. Machines that do not have an agent yet appear as Not Installed, and the table filter can show only them.

  2. 2
    Select machines and open deployment

    Check the machines you want to deploy to, then click Install / Uninstall Agents (N) in the table toolbar.

  3. 3
    Choose operation, delivery, and credentials

    Pick Install or Uninstall, select Server Download or Local Push, and on Windows choose the MSI or EXE package. Then enter the administrative credentials: local admin or domain admin for Windows, a password or an SSH key for Linux and macOS.

  4. 4
    Start the run and watch live progress

    Click Start Deployment. The log console streams every target line by line while the Operation Status column shows Pending, Running, Success, or Failed for each machine.

  5. 5
    Review, retry, and export

    The deployment report summarizes successes and failures. Use Retry Failed for the machines that did not complete, and Export CSV Report for an audit-ready record.

Provisioning is real, never simulated
Each deployment writes the full agent API address (your server URL plus /api/agent), the Company ID, and the NATS address onto the target, then starts the service and reports the actual result. If a credential, a package download, or a port fails, that machine is marked Failed with the real error so you can fix it and retry only that target.

Configuration Injection & Service Restart#

  • The update is identity-preserving: the tool safely updates each machine's connection settings to point at the new server, without touching the machine's identity, pairing, or credentials. It only redirects where the agent reports to - nothing else about the agent changes.
  • On Windows, this update and the following service restart are handled through the machine's built-in remote management features.
  • On Linux and macOS, the same update and service restart are handled through the machine's remote access features.
Remote access on Windows targets
Remote management must be enabled on Windows targets for the tool to update them. For workgroup (non-domain) Windows machines, User Account Control can block remote administrative access unless it is configured to allow it - see Troubleshooting below if you hit Access is Denied errors.

Step-by-Step Usage#

  1. 1
    Define and test the new server address

    In the header, enter the new server IP/URL (e.g. http://192.168.1.200:8000) and, optionally, the Company ID. Click Test Server - a green Online (X ms) result confirms the new server is reachable before you touch any client.

  2. 2
    Discover the fleet

    Choose Workgroup / Subnet Mode (enter a CIDR such as 192.168.1.0/24, pick a scan timeout, and optionally provide local admin credentials, then click Start Subnet Scan) to scan your local network, or Active Directory / Domain Mode (enter your domain details, an optional Base OU filter, and Domain Admin credentials, then click Query Domain Computers) to pull the machine list directly from your Active Directory domain.

  3. 3
    Select targets and review status

    The results table lists each machine's IP, operating system, current server IP, and agent status (Offline / Server Down, Running, Stopped). Search by hostname, IP, or user, then check the machines you want to rescue, or select all.

  4. 4
    Push config and restart the service

    Click Reconfigure & Restart Selected (X). In the confirmation modal, leave Restart Moftgate Agent Service remotely and Verify Agent Handshake checked, then click Start Migration. The Live Log Console streams each machine's progress line by line as its connection settings are updated and its agent restarts.

  5. 5
    Verify and export the report

    When the run finishes, the Migration Execution Report summarizes successes and failures. Use Export CSV Report for a detailed migration report, and Retry Failed to re-run only the machines that failed or were offline during the scan.

The live migration console streams real-time connection updates, service restart triggers, and handshake verification across all selected endpoints.
Live Migration Log Console & Reconfiguration Status
Close image

Troubleshooting#

Symptom / ErrorLikely CauseFix
"Unreachable" (Test Server error)The new Moftgate server address is wrong, or a firewall is blocking the connection.Double-check the server address, and make sure your firewall allows the management machine to reach it.
"Access is Denied"The account used doesn't have administrative rights on the target machine.Use an account with local admin rights (or domain admin rights, for Active Directory mode) on the target machines.
Some machines are unreachableRemote management may be disabled on that machine, or it may be blocked by network/security policy.Enable remote access on the target machine, check with your network team, or contact IT support.
Linux/macOS machines don't respondRemote access isn't available on that machine.Make sure remote access is enabled on the target machine, or contact IT support.
A subnet scan finds 0 devices, even the management machine itselfOn macOS, Remote Login (SSH) and File Sharing (SMB) are disabled by default, so the scan has no open port to detect the machine on.On the Mac running the scan, go to System Settings > General > Sharing and enable Remote Login (SSH) - and File Sharing if you also want SMB-based detection - then rescan.
Deployment fails with authentication or "Access is Denied" errorsThe credentials lack administrative rights, or remote management is not enabled on the target.Use an account with local or domain admin rights. On Windows targets, enable WinRM (winrm quickconfig) or install OpenSSH Server; on Linux and macOS, make sure SSH is running.
Windows install reports success but the agent never comes onlineThe MSI properties may be wrong, or the target cannot reach the Moftgate server after the install finishes.Verify the server URL includes the full API base (for example https://server/api/agent), confirm the target can reach the server and the NATS address, then retry that machine.

Frequently Asked Questions#

Does the tool change an agent's identity or pairing with the server?
No. The update only changes which server the agent connects to (and, if provided, the Company ID). The machine's identity and existing pairing with the central server are left untouched, so they survive the migration.
Can I migrate Windows, Linux, and macOS machines in the same run?
Yes. The discovery table lists machines regardless of OS, and you can select a mixed batch of targets - the tool automatically uses the right method for each machine's operating system within the same migration job.
What happens to machines that are offline during the scan?
They show up as Offline / Server Down (or simply do not appear in a subnet scan if unreachable) and are skipped during that migration run. Once the migration report is generated, use the Retry Failed button to re-run just the machines that failed or were unreachable, without repeating the whole fleet.
Is Active Directory required to use this tool?
No. Active Directory / Domain mode is one of two discovery methods - it is optional and only useful in domain environments. Workgroup / Subnet mode works entirely without it, scanning your local network directly.
Is this tool part of the main Moftgate platform?
No. It is a separate, standalone desktop application (the Moftgate Fleet Discovery & Rescue Tool) that an administrator downloads from the Moftgate website, installs like any other desktop app, and runs from one management machine - it is not a page inside the Moftgate web platform.
Can the tool install agents on machines that never had Moftgate?
Yes. Bulk deployment handles first-time rollouts: any reachable Windows, Linux, or macOS machine with remote access enabled can receive a fresh agent install, fully provisioned with your server address and Company ID.
Can I remove agents in bulk as well?
Yes. The same deployment modal includes an Uninstall operation that stops and removes the agent service, deletes the binary, and cleans up the configuration on every selected machine.