Technical support

1. Windows: antivirus or EDR software blocks the agent installation
2. Windows: other problems
3. macOS
4. Raspberry Pi and Linux
5. Connection, panel and account
6. Useful commands

Windows: antivirus or EDR software blocks the agent installation

Symptoms

• The security software moves the downloaded myremde-agent-….exe file to quarantine or shows a message such as “Advanced Threat Control has started disinfecting a process detected as malicious… Threat name: ATC.SuspiciousBehavior…” (Bitdefender GravityZone).
• The installer ends with Blad: zapis konfiguracji: open C:\ProgramData\myRemDe\agent.json: Access is denied. or Blad: instalacja zakonczona kodem 1, even though PowerShell is running as administrator.
• After a reboot the myremde-agent service does not start and the file C:\Program Files\myRemDe\myremde-agent.exe is gone.

Why this happens

The BlueWato agent is a single executable without a classic installer: it is downloaded by a PowerShell script, registers a system service, captures the screen and controls the mouse and keyboard. This is exactly how remote-access tools used by criminals behave, and EDR-class products (Bitdefender ATC/HyperDetect, ESET, Microsoft Defender for Endpoint, Sophos, CrowdStrike…) judge a program by its behaviour, not its content. An unknown, unsigned file started from a temporary folder may therefore be blocked before it can write anything. The agent file is not yet signed with a publisher certificate (we are working on it); you can verify its authenticity with a checksum — see below.

Step-by-step solution

1. Add exclusions in the security software — before installing. Exclude the folders C:\Program Files\myRemDe\ and C:\ProgramData\myRemDe\ and the process C:\Program Files\myRemDe\myremde-agent.exe. An exclusion in the file scanner alone is not enough — add it in the behaviour-analysis modules as well:
   • Bitdefender GravityZone (admin console): Policies → the policy assigned to the computer → Antimalware → Settings → Custom Exclusions: add entries of type Folder (both folders) and Process (the .exe) with the modules On-access, ATC/IDS (Advanced Threat Control), Ransomware Mitigation and — if enabled — HyperDetect ticked. Save the policy and wait a few minutes for the computer to receive it. You may restore the file from Quarantine, but it is not necessary.
   • Bitdefender for home users: Protection → Antivirus → Settings → Manage exceptions.
   • Windows Security (Microsoft Defender): Virus & threat protection → Manage settings → Exclusions → Add an exclusion (folder). If Controlled folder access is enabled, also add the agent file to the allowed apps.
   • ESET: Advanced setup (F5) → Detection engine → Exclusions. Other products: look for an “Exclusions” or “Exceptions” section.
2. Generate a new pairing code in the panel. Open the device’s installation page and click New code. The code is single-use: if the previous attempt reached the “Pairing with …” step, the panel has consumed it and another attempt with the old code fails with an “invalid or expired code” error. Since version 0.1.3 the agent checks that it can write its files before pairing, so a write block no longer wastes the code.
3. Run the command from the panel again in PowerShell as administrator. The installer saves the agent directly as C:\Program Files\myRemDe\myremde-agent.exe (not in a temporary folder), so the exclusions from step 1 also cover the installation itself. After a failed attempt the file stays in place — once the exclusions are added, the install command alone is enough:

   & "C:\Program Files\myRemDe\myremde-agent.exe" install --code NEW_CODE --server https://panel.bluewato.com

4. Without the script: download myremde-agent-windows-amd64.exe (or arm64) from the panel, save it as C:\Program Files\myRemDe\myremde-agent.exe and run the command from step 3. When started manually, SmartScreen may show “Windows protected your PC” — click More info → Run anyway.
5. Check the result: Get-Service myremde-agent should report Running, the log C:\ProgramData\myRemDe\agent.log shows a connection to the panel, and the device in the panel changes to online.

Get-FileHash "C:\Program Files\myRemDe\myremde-agent.exe" -Algorithm SHA256

Windows: other problems

• The service does not start after a reboot, the device is offline. Check Get-Service myremde-agent. If C:\Program Files\myRemDe\myremde-agent.exe is missing, the antivirus removed it (see the section above). If the service is running but the device is still offline, look at the log C:\ProgramData\myRemDe\agent.log and make sure the computer can reach https://panel.bluewato.com.
• The desktop is black, the console works. The service did not start the worker process in the logged-in user’s session. Look for “agent uruchomiony w sesji” in the log; Restart-Service myremde-agent or signing the user out and in again helps.
• Ctrl+Alt+Del from the panel does not work. The agent was installed by an older version that did not set the SAS policy. Repeat the installation (the panel command or myremde-agent install).
• The connection is slow or goes through the relay. The installer creates a Windows Firewall rule for the agent file; if it was removed, repeat the installation. Network firewalls that block UDP force a detour via the TURN server — see “Connection”.

macOS

• “Cannot be opened because it is from an unidentified developer”. A file downloaded with a browser gets a quarantine flag. The panel command removes it automatically; for a manual download run xattr -d com.apple.quarantine ~/Downloads/myremde-agent-darwin-arm64 first.
• The desktop shows only the wallpaper. Screen-recording permission is missing: System Settings → Privacy & Security → Screen & System Audio Recording → enable myremde-agent. After an agent update the system may ask again.
• There is an image, but the mouse and keyboard do not respond. The Accessibility permission in the same settings is missing.
• The device is offline after restarting the Mac. The agent runs in the logged-in user’s session. Sign in on the Mac or enable automatic login (Users & Groups).

Raspberry Pi and Linux

• The device is offline. Check the service: sudo systemctl status myremde-agent, the log: sudo journalctl -u myremde-agent -f. Make sure the device can reach the panel (curl -sI https://panel.bluewato.com) and has the correct time (timedatectl).
• Black desktop or “no graphical environment”. There is no graphical session on the device (e.g. a headless system) or it uses an unsupported compositor. The console works independently of the desktop; install headless devices with the “console only” option (--no-screen).
• The mouse and keyboard do not respond. The uinput module is missing: sudo modprobe uinput. The installer adds the module to /etc/modules-load.d, so it loads automatically after a reboot.
• Pairing code rejected. The code is single-use and valid for 60 minutes — generate a new one in the panel and repeat the installation.

Connection, panel and account

• “unauthorized” in the agent log, device offline. A new pairing code was generated for this device in the panel, which invalidated the existing token. Install the agent again with the new code.
• The session does not connect or the image is very slow. The network on one side blocks UDP, so the data goes through the TURN relay instead of directly. Allow outgoing UDP (at least to port 3478 of panel.bluewato.com) and check that a firewall is not blocking the browser or the agent.
• “Ticket invalid or expired”. The clock of the computer or device is wrong. A session ticket is valid for two minutes, so enable time synchronisation and try again.
• A device in standby does not wake up. Click the device card again; waking usually takes up to a dozen seconds. If the device stays in standby, check its connection to the panel.
• The 2FA code does not arrive. Check the spam folder; the sender is info@bluewato.pl. Add this address to your contacts so that future codes reach your inbox.
• “Too many attempts”. The sign-in or pairing rate limit was triggered. Wait 15 minutes and try again.
• The session ends after 30 minutes. This is the single-session limit of the Free plan (not enforced during the launch period). You can reconnect immediately or change the plan in the panel.

Useful commands

After removing the agent, delete the device in the panel as well (device menu → Delete device).

Last updated: 2026-08-27 · Contact