> For the complete documentation index, see [llms.txt](https://docs.nexthink.com/platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/manual-installation-on-macos-tp.md).

# Installing Collector manually

Install Collector manually on macOS using the graphical wizard or the command line. Use this method for a small number of devices or when a deployment tool is not available. After installation, grant full disk access to the required components.

## Installation

You can install Collector on macOS either by using the graphical installation wizard or from the command line.

Choose the installation method that best fits your deployment scenario:

{% tabs %}
{% tab title="Wizard installation" %}
To install Collector on macOS using the Wizard installation:

{% stepper %}
{% step %}
Double-click the provided disk image file to mount it into your filesystem and see its contents.
{% endstep %}

{% step %}
Double-click the package file `Nexthink_Collector_<version>.pkg` and the installer will start with the introduction.
{% endstep %}

{% step %}
Select **Continue** to proceed.
{% endstep %}

{% step %}
In the step **Personalization**, configure the **Nexthink Appliance** to which Collector will connect:

<figure><img src="/files/oTeunJ9vdQ2gkNilBkYw" alt="" width="476"><figcaption></figcaption></figure>

| Setting                | Description                                                |
| ---------------------- | ---------------------------------------------------------- |
| **Name or IP address** | The FQDN of your Nexthink instance.                        |
| **Data over TCP**      | Select this option to send data over a TCP channel.        |
| **TCP port**           | `443`                                                      |
| **UDP port**           | Do not select this when using the Nexthink cloud platform. |
| {% endstep %}          |                                                            |

{% step %}
Configure the Collector proxy settings:

* Select **Automatic proxy** for Collector to take its configuration from a proxy auto-configuration (PAC) file. In **PAC address**, type in the URL of the file that determines the proxy to use.
* Select **Manual proxy** for Collector to use the following proxy settings:

| Setting       | Description                                           |
| ------------- | ----------------------------------------------------- |
| **Address**   | Type in the FQDN of the proxy.                        |
| **Port**      | Type in the port number where the proxy is listening. |
| {% endstep %} |                                                       |

{% step %}
Configure the other settings of Collector:

<figure><img src="/files/FEg45UOn8hrdAMI05469" alt=""><figcaption></figcaption></figure>

<table data-search="false"><thead><tr><th>Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Customer Key</strong></td><td>Copy and paste the contents of the file that holds the Customer Key.</td></tr><tr><td><strong>Root CA</strong></td><td>Leave this field empty.</td></tr><tr><td><strong>Collector tag</strong> (optional)</td><td>An integer number (0—2,147,483,647) that identifies a group of Collectors; used for defining entities in hierarchies.</td></tr><tr><td><strong>Collector string tag</strong> (optional)</td><td>A label (max 2,048 characters) that identifies a group of Collectors; used for defining entities in hierarchies.</td></tr><tr><td><strong>Assignment service</strong> (optional)</td><td>Select if you have activated rule-based assignment (classic).</td></tr><tr><td><strong>Nexthink Engage</strong> (optional)</td><td>Select to activate Campaigns features on this device.</td></tr><tr><td><strong>Execution policy of scripts included in remote actions</strong> (optional)</td><td><p>Select the behavior:</p><ul><li><strong>Disabled</strong> (default): Collector runs no remote action on the device.</li><li><strong>Unrestricted</strong>: Collector runs any remote action on the device, regardless of the digital signature of its script.</li><li><strong>Trusted publisher</strong>: Collector runs on the device only those remote actions with a shell script that is signed by an identified developer.</li><li><strong>Trusted publisher or Nexthink</strong>: Collector runs on the device only those remote actions with a shell script that is signed either by Nexthink or by an identified developer.</li><li><strong>Pinned</strong>: Collector runs on the device only remote actions with a shell script signed with a signature, whose leaf certificate thumbprint is allowed via the <code>cert_fingerprints</code> argument.<br>Refer to <a href="/pages/aSXHNoOMrnDIK0DB3Cm5#option-2-relying-on-certificate-pinning">Certificate pinning</a> for more information.</li><li><strong>Pinned or Nexthink</strong>: Collector runs on the device only remote actions with a shell script signed either by Nexthink or signed with a signature, whose leaf certificate thumbprint is allowed via the <code>cert_fingerprints</code> argument.<br>Refer to <a href="/pages/aSXHNoOMrnDIK0DB3Cm5#option-2-relying-on-certificate-pinning">Certificate pinning</a> for more information.</li></ul></td></tr></tbody></table>
{% endstep %}

{% step %}
**Certificate fingerprints**: If you selected `Pinned` or `Pinned or Nexthink` in the previous step,\
define an *allow list* of script signature thumbprints separated by a single `,` without spaces surrounding it. The script signature thumbprint must match the signature's **leaf certificate** thumbprint. Refer to [Certificate pinning](/platform/user-guide/remote-actions/setting-up-and-managing-remote-actions/creating-remote-actions/writing-scripts-for-remote-actions-on-mac.md#option-2-relying-on-certificate-pinning) for more information.
{% endstep %}

{% step %}
Select **Continue** to proceed.
{% endstep %}

{% step %}
In the step **Destination select**, the installer program shows the local paths in the system where it is going to install the different components of Collector. Keep the default paths and select **Continue**.
{% endstep %}

{% step %}
The **Installation Type** step shows details of the installation process, including the amount of disk space that the program is going to use. Select **Install** to begin with the installation.
{% endstep %}

{% step %}
The installer shows the progress of the installation, and it finishes with a summary message. If the installation was successful, select **Close** the installer.
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="CLI installation" %}
The command-line installation lets you install Collector when you have access only through the macOS shell, including remotely through an SSH connection.

{% stepper %}
{% step %}
**Determine where you are installing Collector**:

Choose the applicable option:

<details>

<summary>If you are installing Collector on a remote computer</summary>

* Copy the image file to the remote computer:

```bash
scp Nexthink_Collector_<version>.dmg <username>@<address>
:
```

* Log in to the remote computer:

```bash
ssh <username>@<address>
```

</details>

<details>

<summary>If you are installing Collector on the local computer</summary>

* Change the directory containing the `Nexthink_Collector_<version>.dmg` file.

</details>
{% endstep %}

{% step %}
**Mount the image file** by running the following command:

```bash
hdiutil mount Nexthink_Collector_<version>.dmg
```

{% endstep %}

{% step %}
**Change the directory containing the** `csi.app` **file.**

For example, run the following command when using Collector version 22.6.2.10:

```bash
cd /Volumes/Nexthink_Collector_22.6.2.10\ OSX\ 10.15\ -\ 12/csi.app/Contents/MacOS/
```

{% endstep %}

{% step %}
Run the installer:

```bash
sudo ./csi
```

Use the following arguments:

<table data-full-width="false" data-search="false"><thead><tr><th width="191.25">Argument</th><th width="131.25">Required</th><th>Description</th></tr></thead><tbody><tr><td><code>address</code></td><td>mandatory</td><td>FQDN of your Nexthink instance.</td></tr><tr><td><code>port</code></td><td>mandatory</td><td>Do not select when using the Nexthink cloud platform.</td></tr><tr><td><code>tcp_port</code></td><td>mandatory</td><td>Port number; set to <code>443</code>.</td></tr><tr><td><code>rootca</code></td><td>mandatory</td><td>Not required; leave empty.</td></tr><tr><td><code>key</code></td><td>mandatory</td><td>Path to your Customer Key file</td></tr><tr><td><code>engage</code></td><td>optional</td><td>Whether to enable Campaigns.<br>Default value: <code>disable</code></td></tr><tr><td><code>data_over_tcp</code></td><td>optional</td><td>Whether to enable to send of all data over TCP.<br>Default value: <code>enable</code></td></tr><tr><td><code>use_assignment</code></td><td>optional</td><td>Whether to enable rule-based assignment (classic).<br>Default value: <code>disable</code></td></tr><tr><td><code>ra_execution_policy</code></td><td>optional</td><td><p>Whether to enable the remote actions. Values:</p><ul><li><code>disabled</code> (default): Collector runs no remote action on the device.</li><li><code>unrestricted</code>: Collector runs any remote action on the device, regardless of the digital signature of the associated script.</li><li><code>signed_trusted</code>: Collector runs on the device only remote actions with a shell script signed by an identified developer.</li><li><code>signed_trusted_or_nexthink</code>: Collector runs on the device only remote actions with a shell script signed either by Nexthink or an identified developer.</li><li><code>signed_pinned</code>: Collector runs on the device only remote actions with a shell script signed with a signature, whose leaf certificate thumbprint is allowed via the <code>cert_fingerprints</code> argument.<br>Refer to <a href="/pages/aSXHNoOMrnDIK0DB3Cm5#option-2-relying-on-certificate-pinning">Certificate pinning</a> for more information.</li><li><code>signed_pinned_or_nexthink</code>: Collector runs on the device only remote actions with a shell script signed either by Nexthink or signed with a signature, whose leaf certificate thumbprint is allowed via the <code>cert_fingerprints</code> argument.<br>Refer to <a href="/pages/aSXHNoOMrnDIK0DB3Cm5#option-2-relying-on-certificate-pinning">Certificate pinning</a> for more information.</li></ul></td></tr><tr><td><code>tag</code></td><td>optional</td><td>Integer (0—2,147,483,647) to identify an individual or batch installation of Collectors.</td></tr><tr><td><code>string_tag</code></td><td>optional</td><td>Label (maximum 2,048 characters) to identify an individual or batch installation of Collectors.</td></tr><tr><td><code>proxy_pac_address</code></td><td>optional</td><td>URL of a PAC file for automatic proxy configuration.</td></tr><tr><td><code>proxy_address</code></td><td>optional</td><td>FQDN of a proxy for manual proxy configuration.</td></tr><tr><td><code>proxy_port</code></td><td>optional</td><td>Port number where a proxy is listening for manual settings.</td></tr></tbody></table>

#### Example

```bash
sudo ./csi -address <instance_address>
-tcp_port <instance_tcp_port>
-key <customer_key_file>
-engage enable
-proxy_pac_address <pac_URL>
-proxy_address <proxy_FQDN_or_IP> -proxy_port <port_number>
-tag 1000 -string_tag Preproduction
```

{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}

## Full disk access

Nexthink Collector relies on the Apple Endpoint Security framework and follows Apple privacy guidelines. Some Collector components need full disk access to collect complete data and run remote actions on devices.

The following Collector components need full disk access:

* `nxtsvc`: Collects core device data and binary executions and connections events. Permission for this module is mandatory; required by Apple Endpoint Security and Apple privacy controls.
* `nxtcod`: Executes remote actions on user devices and sends results back to Nexthink. Permission for this module is optional; grant it only if remote actions need access to special folders or shared network resources.

Full disk access affects Collector differently depending on the version:

* **Collector version 26.5 or later** runs in limited mode until you grant full disk access. It starts full data collection and can run remote actions only after you grant it.
* **Collector versions earlier than 26.5** cannot run without full disk access.

### Granting full disk access

Install Collector first and then grant full disk access to the relevant components by following the steps below.

{% hint style="info" %}
This procedure requires a user with administrator rights.
{% endhint %}

{% stepper %}
{% step %}
Select **System Settings > Privacy & Security > Full Disk Access**.
{% endstep %}

{% step %}
Select **+**, browse to `/Library/Application Support/Nexthink/nxtsvc.app`, and enable the toggle.
{% endstep %}

{% step %}
If you need to run remote actions on the device, select **+**, browse to `/Library/Application Support/Nexthink/nxtcod.app`, and enable the toggle.
{% endstep %}

{% step %}
Stop and relaunch Collector for the changes to take effect.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.nexthink.com/platform/configuring_nexthink/bringing-data-into-your-nexthink-instance/deploying-nexthink-in-non-vdi-environment/installing-collector/installing-collector-on-macos/manual-installation-on-macos-tp.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.