Deploying the Log Collector Across a Fleet

Installing the Chipper Log Collector one machine at a time is fine for a single instrument PC. When your IT team manages many Windows machines, deploy it the way you deploy everything else — silently, through Intune, SCCM/MECM or Group Policy, with one installer and one shared property set.

The piece that makes this work is a reusable enrollment token: one token that enrolls your whole fleet, so you don't have to mint and embed a unique token per machine.

When to use fleet deployment

Use fleet deployment if...	Use the single-PC install if...
✅ You manage machines with Intune / SCCM / GPO	❌ You're setting up one instrument PC → Log Collector
✅ You push one MSI + one property set to many boxes	❌ You want the interactive, one-time install
✅ You need silent, unattended, repeatable installs	❌ You'll click through the installer by hand

Everything about how the Collector runs — the service, config, auto-update — is identical to the single-PC install. This guide only covers getting it onto many machines at once. For what to configure once it's installed, see Configure on the Log Collector page.

How fleet enrollment works

Each machine installs the same MSI with the same ENROLL_CODE. On first boot, every collector redeems that token independently and registers itself as its own collector in Chipper — up to the token's machine limit, or until it expires.

Step 1 — Mint a reusable enrollment token

In Chipper, go to Integrations → Log Collector → Enroll a collector.
Under How many machines will use this token?, choose Multiple machines (mass deployment).
Set:
- Maximum machines — the number of boxes this token may enroll (it stops working once that many have enrolled).
- Token expires in — how long the rollout window stays open (up to 30 days).
Generate token, then copy the deployment command it hands back — that command carries the ENROLL_CODE (and, on non-production environments, a FIBER_URL) you'll push to the fleet.

A reusable token is bounded on purpose

It's valid until either the machine limit or the expiry is reached — whichever comes first. Size the limit to your fleet (a little headroom for re-images is fine) and keep the window only as long as the rollout needs. Mint a fresh one for the next wave. Tokens are revocable at any time from the same screen, and Chipper stores only a hash — copy it when it's shown, because it isn't retrievable later.

A single-use token (the default, "One machine") is the right choice for an interactive one-off install; it enrolls exactly one machine and is capped at 24 hours. Fleet deployment needs the reusable token.

Step 2 — Install silently with MSI properties

The Collector's enrollment settings are passed as MSI properties on the msiexec command line. The installer persists them to the registry (HKLM\SOFTWARE\Chipper\Collector), and the agent reads them on first boot to enroll.

msiexec /i chipper-collector.msi /quiet /norestart ENROLL_CODE=enr_your-reusable-token

On a non-production environment, include the API host so the fleet enrolls against the right environment instead of production:

msiexec /i chipper-collector.msi /quiet /norestart FIBER_URL=https://your-env-api.chipper.bio ENROLL_CODE=enr_your-reusable-token

MSI properties

Property	Required	Default	Purpose
`ENROLL_CODE`	Yes	(none)	The enrollment token the collector redeems on first boot. Use your reusable token here. Treated as secret — it isn't echoed in the install UI.
`FIBER_URL`	No	`https://api.chipper.bio`	The Chipper API the collector enrolls against. Omit on production; set it for dev/staging environments.

Copy the exact command from Chipper

The Generate token result gives you a ready-to-run command with ENROLL_CODE already filled in (and FIBER_URL on non-prod). Copy that rather than hand-typing the token — it's long and easy to mistype.

Treat the deployment command as a secret

ENROLL_CODE is passed on the msiexec command line, which Windows and your management tooling (Intune/SCCM/GPO) may capture in install logs and process history. Restrict who can read those logs, and revoke the token from Integrations → Log Collector once the rollout is complete (or mint a short-expiry token sized to the rollout window). Anyone who obtains a still-valid token can enroll a collector until it expires or is exhausted.

Silent-install flags

Flag	Meaning
`/i`	Install
`/quiet`	No UI, no prompts (unattended) — same as `/qn`
`/norestart`	Don't reboot the machine, even if the installer would otherwise ask
`/l*v log.txt`	Write a verbose install log (useful when debugging a failed deployment)
`/x`	Uninstall (see below)

Deploy via Intune

Package the MSI as a Win32 app (.intunewin via the Microsoft Win32 Content Prep Tool) so you can pass the ENROLL_CODE property — the plain "Line-of-business app" MSI type doesn't let you supply custom properties.

Install command:

msiexec /i chipper-collector.msi /quiet /norestart ENROLL_CODE=enr_your-reusable-token

Uninstall command:

msiexec /x chipper-collector.msi /quiet /norestart

Install behavior: System
Detection rule: use the MSI product code — Intune auto-detects it from the packaged MSI, and it's the native option. (Intune's built-in rule types are MSI product code, file, or registry; there's no "service exists" rule, so detecting the ChipperLogCollector service instead requires a custom detection script.)

Assign the app to your device group; Intune installs it silently on next check-in.

Deploy via SCCM / MECM

Create an Application with a Windows Installer (*.msi) deployment type, then override the installation program to include the property:

Installation program:

msiexec /i chipper-collector.msi /quiet /norestart ENROLL_CODE=enr_your-reusable-token

Uninstall program:

msiexec /x chipper-collector.msi /quiet /norestart

Detection method: the MSI product code (the native option), or a custom script that checks for the ChipperLogCollector service.
Install behavior: Install for system.

Deploy to a device collection as Required for a hands-off rollout.

Deploy via Group Policy (GPO)

GPO Software Installation publishes an MSI but can't pass properties directly — use one of:

Startup script (recommended): a computer Startup PowerShell/batch script that runs the msiexec command with ENROLL_CODE, guarded so it only installs once:

if (-not (Get-Service ChipperLogCollector -ErrorAction SilentlyContinue)) {
    Start-Process msiexec.exe -Wait -ArgumentList `
        '/i', '\\fileserver\share\chipper-collector.msi', '/quiet', '/norestart', `
        'ENROLL_CODE=enr_your-reusable-token'
}

MST transform: author a transform (.mst) that sets ENROLL_CODE/FIBER_URL and attach it to a GPO Software Installation package.

Place the MSI on a share every target machine can read, and confirm outbound HTTPS to the API host is allowed.

Application allowlisting (AppLocker / WDAC)

If your environment blocks unapproved installers, allowlist the Collector:

By file hash (available today): compute the installer's SHA-256 and allow that hash.
```
Get-FileHash chipper-collector.msi -Algorithm SHA256
```
Re-hash and update the rule whenever you adopt a new Collector version (the auto-updater fetches new builds from downloads.chipper.bio).
By publisher (once code signing ships): allow the publisher on the signing certificate so you don't have to re-hash on every update.

Code signing is rolling out

The Collector MSI is in the process of being code-signed. Until the signed installer ships, allowlist by file hash. Once signing is live, switch to a publisher rule — it survives version bumps without a rule change. If you need the current publisher/thumbprint or file hash for your allowlist, contact support.

Verify the rollout

Per machine: Get-Service ChipperLogCollector reports Running.
Across the fleet: each enrolled machine appears in Chipper's collector fleet view, with its hostname and last-seen time.
Watch the token's remaining-machines count go down as boxes enroll — when it's exhausted (or expired), further installs won't enroll until you mint a new one.

Each collector still needs at least one sink (and its storage credentials) in collector.toml before it ships data — those stay local to each machine. See Configure on the Log Collector page.

Uninstall at scale

Silently, per machine:

msiexec /x chipper-collector.msi /quiet /norestart

Through your management tool, run the same command as the app's uninstall action (Intune uninstall command, SCCM uninstall program, or a GPO removal). Revoke any still-valid enrollment token afterwards from Integrations → Log Collector.

Troubleshooting

A machine installed but never appeared in Chipper

Token exhausted or expired: if the rollout outgrew the token's machine limit or ran past its expiry, later machines can't enroll. Mint a fresh reusable token and re-run the install on the affected boxes.
Wrong environment: confirm FIBER_URL (or the production default) points at the API you're checking. The persisted values live under HKLM\SOFTWARE\Chipper\Collector.
Network: the machine needs outbound HTTPS to the API host to enroll.
Logs: the agent writes to C:\ProgramData\Chipper\Collector\logs\.

The install itself failed

Re-run with a verbose log and inspect it: msiexec /i chipper-collector.msi /quiet /l*v install-log.txt ENROLL_CODE=enr_your-reusable-token.
If an allowlist is blocking the MSI, see Application allowlisting.

Need help?

Machines not enrolling? Check the token isn't exhausted/expired and that FIBER_URL is correct.
Installer blocked? Ask support for the current publisher/hash for your allowlist.
Other questions? Contact support.

When to use fleet deployment​

How fleet enrollment works​

Step 1 — Mint a reusable enrollment token​

Step 2 — Install silently with MSI properties​

MSI properties​

Silent-install flags​

Deploy via Intune​

Deploy via SCCM / MECM​

Deploy via Group Policy (GPO)​

Application allowlisting (AppLocker / WDAC)​

Verify the rollout​

Uninstall at scale​

Troubleshooting​

A machine installed but never appeared in Chipper​

The install itself failed​

Need help?​