> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: Enroll multiple branch hosts

> Issue multiple one-time Agent enrollments and manage inventory without broad fleet automation.

# Enroll and organize several remote hosts

**Outcome:** A small operator team enrolls two branch PCs/servers securely and collects them in one Managed Host Group without changing their service permissions or network identity.

## Step 1 — prepare each site

Each destination must have outbound connectivity to the Server's enrollment/control endpoints and permission to install the platform-specific Agent. Follow [Linux](https://link.datarelay.run/getting-started/linux-client.md), [Windows](https://link.datarelay.run/getting-started/windows-client.md) or [macOS](https://link.datarelay.run/getting-started/macos-client.md) requirements before running the generated installer. The Server must already be installed from a product distribution.

## Step 2 — issue a bounded enrollment batch

![Real Data Relay Link CLI capture — Real enrollment list excerpt: completed, expired and revoked states; no raw enrollment tickets displayed.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/enrollment-inventory.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=ff39ebcccf74d3459bf376430d61cc12)

*Figure 1. Real enrollment list excerpt: completed, expired and revoked states; no raw enrollment tickets displayed. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
show enrollments
set enrollment bulk
```

The interactive enrollment wizard supports a **count** or **UTF-8 CSV** workflow; at most **10 codes per batch** and **10 active unused codes**. The CSV header is exactly:

```csv theme={null}
label,ssh_user,note
branch-a,operator,Branch A Linux
branch-b,,Branch B management-only
```

Set TTL according to the wizard (default **1 hour**, maximum **24 hours**). **ssh\_user** is optional: an empty value selects management-only enrollment. Never assume the OS account exists merely because its hint was entered.

## Step 3 — install each Agent once

Send the individual generated enrollment/installation command to the corresponding authorized site administrator by a secure channel. Each ticket/code is **single-use**, short-lived and credential-sensitive. Execute the matching generated command on the correct host; do not reuse a consumed ticket or paste an illustrative made-up URL.

On **each Agent Host shell** after installation:

```bash theme={null}
sudo drlink show status
sudo drlink show agent
sudo drlink system diagnostics
```

Expect **Agent Host** role, real enrollment identity and healthy control connectivity. For Windows/macOS use the supported platform's documented CLI invocation rather than assuming the Linux sudo syntax.

## Step 4 — verify both identities on the Server

![Real Data Relay Link CLI capture — Actual Server Managed Host inventory: confirm registered host rows and connected status.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/managed-hosts.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=52a58066aed6814359eb35d29021937b)

*Figure 2. Actual Server Managed Host inventory: confirm registered host rows and connected status. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
show managed-hosts
show managed-host branch-a
show managed-host branch-b
show enrollments
```

Resolve any actual assigned Managed Host names/immutable IDs before proceeding; enrollment labels need not be accepted as privileged identity selectors automatically. Reissuance requires a **new** enrollment credential; reinstalling from an already consumed code is not a recovery mechanism.

## Step 5 — organize inventory

![Actual DRLink Server main CLI menu — choose 1 Managed Hosts for inventory and enrollment](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/server-managed-host-menu.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=686b5d4271301aa544801d7a3b3bf229)

*Figure 3. Real Server CLI menu: choose 1 Managed Hosts for registered hosts and inventory operations. Actual CLI output example.*

**Server REPL:**

```text theme={null}
set managed-host-group branches
set managed-host branch-a group branches
set managed-host branch-b group branches
show managed-host-groups
show managed-host-group branches
```

A **Managed Host Group** organizes registered host inventory. It is **not** a Network Group used as an access-policy selector. Membership alone never creates Remote Services, broadens Remote Access, or rewrites clients.

## Verify / recover

Check that both actual hosts appear in the group, their immutable Managed Host identities are preserved and no unintended Remote Service was automatically published. If enrollment fails, inspect `show enrollments`, expiration/revocation state and Agent `system diagnostics`; do not log or disclose secret ticket material. To adjust only metadata, use `unset managed-host branch-b group branches`. Deleting a Managed Host is a separate irreversible trust/endpoint retirement and requires explicit review.

## Current behavior check — 2026-10-28

The UTF-8 CSV header is label,ssh\_user,note. A blank ssh\_user means management-only enrollment. Zero-Touch can use a verified numeric-IP/private-CA compact launcher without DNS; failed prerequisites must not issue a ticket. Managed Host Group membership is inventory metadata, separate from Network Group policy membership.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)

## Automatic service result in this example

The CSV row `branch-a,operator,...` automatically configures SSH/22 and its public endpoint. `branch-b,,...` is management-only and publishes no SSH. Inspect `show remote-services` on each Agent; do not recreate branch-a SSH manually. A blank `ssh_user` in bulk has different semantics from a blank username in single-host SSH only.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.