Datto RMM macOS agent: steps after the certificate update

Use this if the Mac has never had the Datto RMM agent installed.

IMPORTANT  Only installers downloaded from Datto RMM on or after October 4, 2026 contain the build with the new certificate. Installers downloaded before that date contain the previous build, so discard any saved copies and download a fresh installer for each new deployment. This includes copies stored in deployment scripts, MDM or imaging tools, or shared drives.

1. In Datto RMM, download the macOS agent installer for the site this Mac belongs to.

2. Run the installer on the Mac and follow the prompts until it finishes.

3. A macOS notification titled App Background Activity will appear. Follow The background activity notification.

4. Follow Granting macOS permissions to approve each prompt.

5. Check the device in Datto RMM. It should show as online.

Use this if the Mac shows as online in Datto RMM and is running an agent version earlier than 12497. You don't need to download or reinstall anything.

IMPORTANT  If the device is showing as online in Datto RMM but Web Remote will not connect to the device, do not restart the device; wait for the agent to update itself. If the device has already been restarted and is now showing offline, refer to Offline device.

IMPORTANT  If you use the Agent Browser to attempt to connect to a device that Web Remote cannot reach, the agent may go offline and restart in some cases. If an Agent Browser connection has already been attempted and the device is now showing offline, refer to Offline device.

1. Leave the Mac on and connected. The agent checks for the update on its own schedule and updates to version 12497. This can take a few hours after the release reaches your platform.
2. After the update, a notification titled App Background Activity appears on the Mac. Follow The background activity notification.
3. The first time someone starts a Web Remote session to this Mac, macOS asks for permissions. Follow Granting macOS permissions.

NOTE  If the agent was already reinstalled with the updated certificate (11994 installed on or after October 4, 2026), it updates to 12497 without asking for permissions again. Web Remote keeps working as before.

NOTE  If Web Remote connects but the desktop displays as a black or gray screen, refer to Datto RMM macOS agent: steps after the certificate update.

Use this if the Mac already has the agent but shows as offline in Datto RMM. This often happens after the Mac was restarted while the issue was active, and can result in this error after restart: 

For more information on what causes this error, refer to Malware Blocked error message.

NOTE  This applies to any offline Mac, including Zinfandel devices and Macs running 11994 (or 12202) installed before October 4, 2026. An offline agent cannot receive the update, so it has to be reinstalled. Download a new installer file if you are not sure. Refer to Downloading the Agent or sharing the Agent installer.

NOTE  You do not need to uninstall the old agent first.

1. In Datto RMM, download the macOS agent installer for the site this Mac belongs to. Refer to Downloading the Agent or sharing the Agent installer.
2. Run the installer on the Mac and follow the prompts until it finishes.
3. The device comes back online in Datto RMM, and a notification titled App Background Activity appears on the Mac. Follow The background activity notification.
4. Wait 5 to 8 minutes. During this time the agent updates Web Remote and its other components in the background. Leave the Mac on and connected.
5. Start a Web Remote session to the Mac. macOS asks for permissions at this point. Follow Granting macOS permissions.

If Web Remote is still not available for the device after 8 minutes, go to Reinstall didn't work.

Use this only if you already followed Offline device and the Web Remote option still does not appear for the Mac. You will run three commands in Terminal on the Mac.

IMPORTANT  Type these commands exactly as shown. The second command permanently deletes a folder. Copying and pasting them from this article is the safest option.

1. On the Mac, open Terminal. You will find it in Applications > Utilities, or press Command + Space, type Terminal, and press Return.
2. Go to the agent's folder:

   cd /usr/local/share/CentraStage

3. Delete the AEMAgent folder inside it:

   sudo rm -rf AEMAgent/

   Terminal asks for a password. Type the Mac's administrator password and press Return. Nothing shows on screen while you type, which is normal.

4. Stop the agent service:

   sudo launchctl stop com.centrastage.cag

5. Wait about 10 seconds.

6. Open Finder, go to Applications, and double-click AEM Agent to start it again.

7. Check the device in Datto RMM. The Web Remote option should now be available.

8. Start a Web Remote session and follow Granting macOS permissions.

After the certificate update, macOS can keep the old permission entries for AEM Agent. They look switched on in System Settings, but they belong to the previous certificate, so macOS ignores them. Common signs include:

• Web Remote connects but shows a black or gray screen, sometimes with only the menu bar visible.
• Web Remote shows the screen but can't control the mouse or keyboard.
• The macOS permission prompts never appear.

IMPORTANT  Turning the AEM Agent switch off and back on does not fix this. The old entry has to be cleared.

Use one of these options.

Option 1: reset in Terminal (recommended)

1. On the affected Mac, open Terminal and run:

   tccutil reset All com.centrastage.tray

2. Start a new Web Remote session. macOS asks for permissions again. Refer to Granting macOS permissions.

Option 2: remove and re-add in System Settings

1. Open System Settings and go to Privacy & Security.
2.  Open the following pages:
   • Local Network
   • Screen & System Audio Recording
   • Accessibility / Device Control and Data Access
   • Full Disk Access
3. On each page, select AEM Agent and click the minus (-) button to remove it. Enter the administrator password if prompted.
4. Start a new Web Remote session and follow Granting macOS permissions. AEM Agent is added back as you approve each prompt. For Full Disk Access, click plus (+) and add AEM Agent from Applications.

In some cases, macOS may detect the Datto RMM Agent as malware and move it to the trash on the device.

The following chain of events triggers this error: 

1. The macOS agent has been offline since before the Rosetta changes in macOS 27, and cannot connect to the platform to retrieve updated information.

   NOTE  For more information on the changes in macOS 27 to Rosetta, and how that affects Datto RMM, refer to Datto RMM Agent not running after upgrading to macOS 27 (Golden Gate).

2. While attempting to regain connectivity by reinstalling Rosetta on the affected device, the agent has an out-of-date configuration.
3. When the AemAgent process starts, Gatekeeper/XProtect inspects it, sees that the configuration is not valid, and blocks/quarantines the application as malware.

Datto RMM is not a virus, so this is a false positive because the device is offline and did not receive an updated certificate. To resolve this issue, refer to Offline device.

After the agent installs or updates, macOS shows this notification in the top-right corner of the screen:

You don't need to click anything. The notification tells you the agent is allowed to run in the background, and it needs to stay that way for the device to stay online.

If someone turned it off, here is how to turn it back on:

1. Open System Settings and go to General > Login Items & Extensions.
2. Under Allow in the Background, find Kaseya International and make sure its switch is on.

The agent needs four macOS permissions for Web Remote to work: Local Network, Screen & System Audio Recording, Accessibility, and Full Disk Access. Prompts will appear for the first three. You must turn on Full Disk Access yourself in System Settings.

The prompts show the app name as AEM Agent. That's the Datto RMM agent.

IMPORTANT  If AEM Agent already shows as switched on but Web Remote doesn't work, don't toggle it off and on. Follow Permissions show as on but Web Remote doesn't work instead.

Local Network and Screen Recording

These two prompts usually appear at the same time.

1. On the Local Network prompt, click Allow.

2. On the Screen Recording prompt, click Open System Settings. Don't click Deny.

3. System Settings opens to Screen & System Audio Recording. Find AEM Agent in the list and turn its switch on. Enter the administrator password if macOS asks for it.

   

4. macOS then says AEM Agent may not be able to record the screen until it is quit. Click Quit & Reopen.

   

Accessibility

This lets Web Remote control the mouse and keyboard.

NOTE  In macOS 27 (Golden Gate), Accessibility was renamed to Device Control and Data Access.

1. When the Accessibility Access prompt appears, click Open System Settings. Do not click Deny.

   

2. System Settings opens to Accessibility. Find AEM Agent and turn its switch on. Enter the administrator password if macOS asks for it.

   

Full Disk Access

macOS doesn't show a pop-up for this one, so you have to turn it on yourself.

1. Open System Settings and go to Privacy & Security > Full Disk Access.

2. Find AEM Agent and turn its switch on. Enter the administrator password if macOS asks for it.

   

Check that everything is on

Open System Settings, go to Privacy & Security, and confirm that AEM Agent is switched on in each of these pages:

• Local Network
• Screen & System Audio Recording
• Accessibility
• Full Disk Access

If one is missing or off, turn it on there. You do not need to wait for the prompt to come back.