Set up your computer or phone for work

Use this guide to enroll your computer or phone in Cadence’s approved device-management program.

What you are installing and why

Cadence uses Fleet to check that computers used for work meet our security requirements and to keep evidence for our ISO-27001 audit. Installing it connects your computer to Cadence’s device-management server, where IT can see its security status and help resolve issues.

On a computer, the installer:

Adds a background service that starts with the computer, checks in with Cadence, and keeps the Fleet agent updated. You do not need to open an app each day.
Reports device and security information, including the operating-system version, installed software, local accounts, and supported checks for encryption, screen locking, and firewall settings. IT uses these results to identify issues that need attention.
Adds Fleet Desktop, a menu-bar or notification-area icon with a My device link for viewing your computer’s status.
Gives the service administrator-level access, including the ability for Cadence’s IT administrators to run scripts on the computer. This is why installation asks for an administrator password or approval. Scripts can read or change things with those privileges.

The computer agent runs on the whole computer; it does not create a separate work profile or move your existing files and apps. The approved device-management proposal describes Cadence’s collection scope. Review it and ask IT about any concerns before installing on a personal computer.

Phones use a different setup: Android creates a separate work profile; iPhone/iPad uses a managed work account and apps through Apple Business. Use the phone guides below for the access involved and the enrollment steps.

Choose your device

Each computer section has its own download link and installation steps. The links open files in Cadence’s handbook repository on GitHub. Sign in with your Cadence-authorized GitHub account if prompted; ask IT for access if GitHub shows 404.

The computer packages below are release 2026-09-14, agent 1.60.0. Cadence’s server address and enrollment settings are already included. You do not need a Fleet account or an enrollment code.

About the download check

Before installing, run the check in your device’s section. It compares your downloaded file against the expected file fingerprint, called a SHA-256 checksum. The expected value is already included in the command—copy the entire code block. You do not need to find a number elsewhere or download a separate checksum file.

Look in the same Terminal or PowerShell window for the success message shown beneath the command. If the check fails, do not install the file: download it again using that section’s link. If it still fails, contact IT. A “file not found” error means the download is not in the stated Downloads folder or its filename differs.

Ubuntu or Debian

1. Download: Fleet installer for Ubuntu/Debian (.deb). Save it in Downloads, keeping the filename cadence-fleet-linux-amd64.deb.

This package is for Intel/AMD 64-bit Linux with systemd. Run uname -m in Terminal; it should say x86_64. Ask IT for a different build for ARM or 32-bit systems.

2. Check the download: Open Terminal, paste this entire block, and press Enter:

cd ~/Downloads
sha256sum --check <<'EOF'
3aef5a5e3f750d29d61a7f4164a5bd2ee250d742e621425353fdf2391cf8b546  cadence-fleet-linux-amd64.deb
EOF

In the same Terminal window, look for:

cadence-fleet-linux-amd64.deb: OK

3. Install: Once the check says OK, run these commands. Enter your computer’s administrator password when prompted:

sudo apt install ./cadence-fleet-linux-amd64.deb
systemctl is-active orbit

The service should report active. If the same package version is already installed, use sudo apt install --reinstall ./cadence-fleet-linux-amd64.deb.

Fedora or RHEL-family Linux

1. Download: Fleet installer for Fedora/RHEL-family Linux (.rpm). Save it in Downloads, keeping the filename cadence-fleet-linux-amd64.rpm.

This package is for Intel/AMD 64-bit Linux with systemd. Run uname -m in Terminal; it should say x86_64. Ask IT for a different build for ARM or 32-bit systems.

2. Check the download: Open Terminal, paste this entire block, and press Enter:

cd ~/Downloads
sha256sum --check <<'EOF'
de4ded825b48f2883f44a5ffd03fbabcde303002ec22a1e0f80b6613da8ca883  cadence-fleet-linux-amd64.rpm
EOF

In the same Terminal window, look for:

cadence-fleet-linux-amd64.rpm: OK

3. Install: Once the check says OK, run these commands. Enter your computer’s administrator password when prompted:

sudo dnf install ./cadence-fleet-linux-amd64.rpm
systemctl is-active orbit

If already installed at the same version, use sudo dnf reinstall ./cadence-fleet-linux-amd64.rpm.

The RPM is not signed with a Cadence GPG key. If your system requires signed local RPMs, ask IT for a signed package; keep that system policy enabled.

macOS

1. Download: Fleet installer for Mac (.pkg). Save it in Downloads, keeping the filename cadence-fleet-macos-universal.pkg. The same package works on Apple silicon and Intel Macs.

2. Check the download: Open Terminal from Applications > Utilities, paste this entire block, and press Return:

cd ~/Downloads
shasum -a 256 --check <<'EOF'
15f708d8b029c7d6a940495ed79135f8f8f3c344a0a7d88a21929681636299b4  cadence-fleet-macos-universal.pkg
EOF

In the same Terminal window, look for:

cadence-fleet-macos-universal.pkg: OK

3. Install: Once the check says OK, open Finder > Downloads, double-click cadence-fleet-macos-universal.pkg, and follow Installer’s prompts. Enter your Mac administrator password when prompted.

This custom installer is unsigned and not notarized. If macOS blocks it, first confirm the download and checksum with IT. Then open System Settings > Privacy & Security, find the blocked installer, and choose Open Anyway to allow this specific package. Apple documents this per-item exception. Leave Gatekeeper enabled. If your Mac’s policy prohibits exceptions, IT must provide a signed installer.

For an IT-assisted Terminal installation of the verified package:

sudo installer -pkg "$HOME/Downloads/cadence-fleet-macos-universal.pkg" -target /
sudo launchctl print system/com.fleetdm.orbit

The launch daemon should be running. This installs the computer agent; Apple MDM enrollment, Apple Business registration, and an Apple Developer membership are not prerequisites.

Full Disk Access is not needed merely to enroll. Some reports read protected system paths and may need it. If IT identifies such a report, review the extra access before granting it under Privacy & Security > Full Disk Access. Fleet explains the access involved.

Windows

1. Download: Fleet installer for Windows (.msi). Save it in Downloads, keeping the filename cadence-fleet-windows-amd64.msi.

Use a supported Windows installation on an Intel or AMD 64-bit computer. Check Settings > System > About > System type for an x64-based processor. Ask IT for a separate ARM64 installer if it says ARM-based.

2. Check the download: Open the Start menu, search for PowerShell, and open it. Paste this entire block and press Enter:

$installer = "$env:USERPROFILE\Downloads\cadence-fleet-windows-amd64.msi"
$expected = '5540a6416b4f428a1aca60942192a480bb3d9709f223caa174330964dc2b9175'
$actual = (Get-FileHash -LiteralPath $installer -Algorithm SHA256 -ErrorAction Stop).Hash
if ($actual -eq $expected) {
    'Installer verified. Continue to step 3.'
} else {
    throw 'Download check failed. Do not install; download the file again or contact IT.'
}

In the same PowerShell window, look for Installer verified. Continue to step 3.

3. Install: Open File Explorer > Downloads, double-click cadence-fleet-windows-amd64.msi, follow the setup wizard, and approve the administrator prompt. This custom MSI is unsigned: if Windows blocks it, confirm the file and checksum with IT. IT must provide a signed package if your computer requires one.

After installation, check the background service in PowerShell:

Get-Service -Name 'Fleet osquery'

Its status should be Running. Look for Fleet Desktop in the notification area, including the hidden-icons menu. Complete the enrollment checks below. This installs the Fleet agent; Microsoft Entra enrollment and Windows MDM are not prerequisites.

For an IT-assisted installation, run this from an administrator PowerShell window and complete the installer dialog:

msiexec.exe /i "$env:USERPROFILE\Downloads\cadence-fleet-windows-amd64.msi"

Confirm it worked

Keep the computer online for a few minutes.
Open the Fleet Desktop menu and select My device if available. IT can also verify directly in Fleet.
Tell IT your computer name (hostname) and work email. IT checks that the host is online and maps it to you.
Review any reported issues with IT. An installed agent is not proof that encryption, antivirus, or every policy is passing.

A running service alone does not prove enrollment. IT must see a recent check-in at devices.cadence15.com.

If it does not appear, send IT the service status and error message. On Linux, journalctl -u orbit --since "10 minutes ago" helps diagnose failures. Do not paste /etc/default/orbit, /opt/orbit/secret.txt, or full diagnostic logs into public channels: they may contain credentials or identifying information. A Cloudflare login page in an agent error is an IT ingress configuration issue, not a request to sign the agent into a browser.

Removing it

Coordinate with IT so the inventory record and work access can be updated.

Windows: Settings > Apps > Installed apps > Fleet osquery > Uninstall, then approve the administrator prompt.
Ubuntu/Debian: sudo apt remove fleet-osquery.
Fedora/RHEL-family: sudo dnf remove fleet-osquery.
macOS: ask IT for the reviewed Fleet uninstall script; deleting Fleet Desktop alone leaves the background agent installed.

IT should confirm the service is stopped and remove the host record when appropriate. Removing the agent does not delete previously collected server-side inventory.

Internal & Confidential: This page is only available in the internal handbook and contains confidential information.