Bootstrap Script

The bootstrap script is the only thing you actually deploy through your RMM. Everything else (check-in, scan, reconcile, capture, poll) is fetched on demand from ZenPrint over the API. So you push one script update per RMM tenant, not one per ZenPrint feature.

What the bootstrap actually does

Each run, in order:

1. Reads the API key from the configured RMM custom field or secret.
2. Collects context from the RMM (device, organization, location) so ZenPrint can wire the endpoint to the right client and location automatically.
3. Runs check-in (unless the mode is Cleanup): fetches and runs a small checkin sub-script that registers/refreshes this endpoint with ZenPrint and caches its endpoint ID. This is why every endpoint ends up registered regardless of which mode you schedule.
4. Fetches the requested sub-script (scan, reconcile, capture, poll) from ZenPrint, authenticated with the API key.
5. Verifies each script’s signature before executing anything. The bootstrap requires a valid signature and refuses to run an unsigned or altered response. If verification fails, the run aborts before executing anything.
6. Checks its own version against the minimum the server expects. Older versions print a warning but keep running.
7. Executes the sub-script with the API key and RMM context as parameters.

The exit code that bubbles up to your RMM is the exit code of the mode sub-script, so failures show up where you’d expect. Check-in is best-effort: if it fails, the mode still runs (it can rely on a previously cached endpoint ID).

Modes

The bootstrap takes one mandatory -Mode parameter. Valid values:

Mode	What it does
Scan	Discovers printers on the network.
Reconcile	Pulls the list of queues that should be installed on this endpoint and applies the difference.
Capture	Extracts driver bytes from a printer that’s been flagged for capture in the UI. No-op when nothing’s pending.
Poll	Reads SNMP supply levels off the network printers at this endpoint’s location. No-op when there are none.
Cleanup	Wipes ZenPrint’s local state on the endpoint (no server call).

Check-in runs automatically before every mode except Cleanup, so an endpoint registers regardless of which mode you run first.

Don’t run all modes at the same cadence. ZenPrint is built for MSP fleets where end users aren’t local admins, so nothing drifts that the operator didn’t initiate. The recommended cadence is deliberately quiet; see Scripts for the per-mode schedule and the reasoning. When you need a change applied faster than its cadence, trigger that mode ad-hoc from your RMM on the specific endpoint.

Version contract

Each bootstrap script carries a version stamp. The dashboard shows a bootstrap update available banner when the running bootstrap is older than the version ZenPrint currently expects. The banner is purely informational and your existing bootstrap keeps working, but newer features and bug fixes may require an update.

If you see the banner:

1. Re-download the bootstrap from Settings → Scripts. The download is generated per-tenant and already has your server URL baked in.
2. Replace the script in your RMM with the new content.
3. Trigger any mode on any one endpoint, or wait for its next scheduled run. The banner clears as soon as one endpoint reports the new version.

You don’t need to re-run the bootstrap on every endpoint manually. Whichever endpoint runs first reports the new version, and the warning clears for the whole tenant.

Cleanup mode

Cleanup wipes ZenPrint’s local state on the endpoint: the registry entries that track which queues have been applied and what configuration each one is on. It doesn’t call the server; everything happens locally.

Use it when:

• You’re offboarding an endpoint that can no longer reach the ZenPrint server
• You’ve offboarded a client and want to remove ZenPrint traces from their endpoints
• You’re recovering from a corrupted local state and want a clean slate

After cleanup, the next Reconcile run re-registers the endpoint and reinstalls every assigned queue from scratch. It’s expensive, since every driver gets re-applied, but it always works.

Cleanup is one step of offboarding a whole customer; see Offboarding a customer for the full sequence.

Security notes

• The API key is the only secret. Treat the RMM custom field or secret as you would any production credential: use the secure or secret field type, restrict who can read it, and rotate it if exposed.
• All communication is over HTTPS. Bootstrap to server, sub-script fetches, manifest uploads: TLS end to end.
• Sub-script integrity is cryptographically verified every run. Each script is signed at ZenPrint build time with a key the server itself does not hold. Your endpoint verifies the signature in memory and refuses to execute if anything in the script bytes has changed, or if the response is unsigned. See Script Signing for how it works. Keep your endpoints on a current bootstrap; the dashboard flags outdated ones.
• Bootstrap version warnings, not hard rejects. If you run an old bootstrap, you’ll see a warning but it keeps working. Hard-rejecting old versions would knock every not-yet-updated endpoint out of management during an upgrade window, until each one’s RMM had pushed the new bootstrap, so we warn instead.