Key Information Solutions Technician access

Technician sign in

Type the six digits your authenticator app shows for Key Information Solutions. Your code is yours alone, so there is nothing else to fill in.

Sign-in attempts are rate limited: after 5 failed attempts this connection is locked out for 15 minutes.

First time here, or a new phone?

Enroll an authenticator

Enroll your authenticator

Your email as it appears in the relay dashboard, and your relay access token — the bearer string shown to you in the dashboard's Users panel and pasted into your MCP configuration. The token is what proves the email is yours; it is checked with the relay and not stored here.

Re-enrolling replaces the authenticator on this account once you confirm a code from the new one. Until then the old one keeps working.

Back to sign in

Set up your authenticator

Hello . In Microsoft Authenticator, Google Authenticator, 1Password, Bitwarden or Authy, add an account and scan this. Then type the six digits it shows to confirm.

Can't scan it?

Add an account by hand with this key. Type it in groups of four; case does not matter.

Account · Issuer · Time-based · 6 digits · 30 seconds

This page works once. After you confirm, the key is never shown again — for a new phone, enrol again from the sign-in page.

You're enrolled

Sign in

Connect to a customer PC

A temporary agent is for a one-off job: run it on the PC and it stays connected while its window is open. Nothing is installed or stored. Closing the window ends it for good, and the relay removes it (also after an hour offline). Pick no customer for a home or walk-in job.

Install puts the permanent KIS remote agent on a customer's PC: run the installer once, as administrator, and the agent installs as a service, joins that customer's group over TLS, and stays reachable. Every download makes a fresh one-time enrolment token; the file is for one PC.

Installer details

The customer list is whatever the relay says you may use. A ticket, if given, is stamped on this PC's install and on every command and file move the relay records for it. The label is only for you: it is kept with the token in the relay so you can tell installers apart. The token lapses after days if it is not used. Installers enrol at .

Looks like this device runs , so that installer is first. Pick another if you are fetching it for a different machine. This looks like . The agent runs on Windows, macOS and Linux computers — open this page on the machine you are working on, or pick the installer for it below.

Windows This device

Windows 10, 11, Server 2016 and newer. Double-click to installrun.

macOS This device

One universal build for Apple silicon and Intel, macOS 12 or newer. InstallsRuns from Terminal.

macOS 10.13 to 11 This device

High Sierra, Mojave, Catalina and Big Sur, Intel or Apple silicon. The macOS build will not start there; this one does.

Linux This device

x86-64 with systemd, any distribution; no libraries needed. InstallsRuns from a shell.

Windows 7 / 8 This device

Also Server 2008 R2 to 2012 R2. The modern build will not start there; this one does.

Other platforms

After it downloads

  1. Run the downloaded file, . Double-clicking is enough: Windows asks for permission and it relaunches itself elevated. Or, from an elevated PowerShell (Run as administrator):
  2. The agent is not code-signed yet, so SmartScreen will object: choose More info, then Run anyway. The customer's antivirus may object too; if the PC does not show up in your hosts list a minute later, that is the first thing to check.
  3. The installer removes any older KIS agent it finds, enrols the PC with the relay, installs the KIS Remote Agent service and starts it. It stays installed and reconnects on its own, so there is no window to leave open.
  4. The file holds a one-time enrolment token. Delete it when the job is done.
  1. Run the downloaded file, , as administrator: right-click, Run as administrator, or from an elevated PowerShell or command prompt:
  2. This is the same agent compiled for the older Windows kernel. It is not code-signed yet either, so expect the SmartScreen or security prompt.
  3. If the browser on that machine cannot reach this page at all (Windows 7 often cannot negotiate modern TLS), download the installer on your own machine and copy it across the network; it does not need the portal again.
  4. The file holds a one-time enrolment token. Delete it when the job is done.
  1. Open Terminal and paste this line. It makes the file runnable, clears the browser's quarantine flag so Gatekeeper lets it start, and runs the agent as root (it asks for the Mac's password):
  2. If macOS still says the developer cannot be verified, allow it once under System Settings → Privacy & Security → Open Anyway, then run the line again.
  3. Grant Full Disk Access once per Mac. The agent runs as root, but macOS still blocks Desktop, Documents, Downloads and removable drives until it is allowed. Open System Settings → Privacy & Security → Full Disk Access, add the agent (the installer prints its exact path) and switch it on. Without it, commands that touch those folders fail with “Operation not permitted”.
  4. The file holds a one-time enrolment token. Delete it when the job is done.
  1. Open Terminal and paste this line. It makes the file runnable, clears the browser's quarantine flag so Gatekeeper lets it start, and runs the agent as root (it asks for the Mac's password):
  2. This is the same agent compiled with an older Go for macOS 10.13 to 11. If macOS says the developer cannot be verified, allow it once under System Preferences → Security & Privacy → General → Allow Anyway, then run the line again.
  3. On 10.14 and later, grant Full Disk Access once per Mac (10.13 has no such setting). Open System Preferences → Security & Privacy → Privacy → Full Disk Access, add the agent (the installer prints its exact path) and tick it. Without it, commands that touch Desktop, Documents, Downloads or removable drives fail with “Operation not permitted”.
  4. The file holds a one-time enrolment token. Delete it when the job is done.
  1. Open a shell on the machine and paste this line. It makes the file runnable and runs the agent as root, which registers a kis-agent systemd service:
  2. The service starts at boot and restarts itself if it stops. Check it with systemctl status kis-agent.
  3. The file holds a one-time enrolment token. Delete it when the job is done.

A temporary agent

  • The file is named kis-agent-temp-…. On Windows, double-click it: it asks for administrator rights and opens a window. On macOS or Linux, run the line above.
  • Leave the window open while you work: the PC shows up in your hosts list marked temporary. Closing the window (or End in the relay dashboard) ends it, and it cannot be reconnected; another session needs a new download.
  • Nothing is installed or stored on the PC, and an installed agent there is not touched. It runs with the rights of the administrator who started it.

If the browser saved the file somewhere other than your Downloads folder, or renamed it (for example with “(1)” added), use the real path and name in the line.

No browser on the target machine?

Download the installer on your own machine with the customer picked above, copy it across (scp, a file share, a USB stick) and run the same line there. The installer carries everything it needs, so the target never has to reach this page.

Your relay identity

Your access token, the customer groups you belong to and the enrolment tokens you have made live in the relay, not here. To see them, open the relay dashboard on the KIS network and sign in with your MCP token.

Open the relay dashboard

That link didn't work

Back to sign in