docs - converting meshctrl pdf to mkdocs
silversword411 committed
May 16, 2022 at 22:33 UTC
97fe37a8e6ded96d1e87586f2b46814f613f9673
10 files changed
+453
-1
docs/docs/meshctrl/images/2022-05-16-21-33-47.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-21-33-47.png differ
docs/docs/meshctrl/images/2022-05-16-21-40-21.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-21-40-21.png differ
docs/docs/meshctrl/images/2022-05-16-21-47-32.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-21-47-32.png differ
docs/docs/meshctrl/images/2022-05-16-21-50-39.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-21-50-39.png differ
docs/docs/meshctrl/images/2022-05-16-21-54-38.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-21-54-38.png differ
docs/docs/meshctrl/images/2022-05-16-22-04-06.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-22-04-06.png differ
docs/docs/meshctrl/images/2022-05-16-22-06-35.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-22-06-35.png differ
docs/docs/meshctrl/images/2022-05-16-22-20-44.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-22-20-44.png differ
docs/docs/meshctrl/images/2022-05-16-22-23-40.png
Binary files /dev/null and b/docs/docs/meshctrl/images/2022-05-16-22-23-40.png differ
docs/docs/meshctrl/index.md
+453
-1
@@ -1,9 +1,461 @@
1
# MeshCtrl
2
3
-[MeshCtrl Command Line Tool](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral2%20Intel%20AMT%20Guide%20v0.0.1.odt)
3
+MeshCmd Guide [as .pdf](https://meshcentral.com/info/docs/MeshCtrlUsersGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCtrl User's Guide v0.0.1.odt?raw=true)
4
5
## Video Walkthru
6
7
<div class="video-wrapper">
8
<iframe width="320" height="180" src="https://www.youtube.com/embed/p_jdtYJyuBQ" frameborder="0" allowfullscreen></iframe>
9
</div>
10
+
11
+
12
+
13
+
14
+## Abstract
15
+
16
+This user guide contains all essential information for the user to make full use of MeshCtrl, a command line tool used to perform tasks on the MeshCentral server. This tool is built in NodeJS and can be run on the same computer as the server, or on a different computer. It’s typically used by administrators to perform various management operations on the MeshCentral server.
17
+
18
+## Introduction
19
+
20
+MeshCtrl, also called “Mesh Control”, is a command line tool built in NodeJS that comes with MeshCentral and allows command line management operation of the MeshCentral server. It can be run both on the same computer as the MeshCentral server, or on a different computer. This tool allows an administrator to list user accounts, create and remove user accounts, list device groups and much more. All of the operations performed by this tool can also be performed using the MeshCentral website, however it’s sometimes useful to automate and script some management operations from the command line and this tool can do this.
21
+
22
+
23
+
24
+MeshCtrl will login to the MeshCentral server using a web socket connection, just like the web application does and so, it needs to login to the server using user or administrator credentials. In the next section, we will cover how to login using MeshCtrl, we then follow with the operations that MeshCtrl can perform.
25
+
26
+## Running MeshCtrl
27
+
28
+MeshCtrl.js is a file that is installed with MeshCentral and is located in the “./node\_modules/meshcentral” folder. You can normally run MeshCtrl like this:
29
+
30
+```
31
+node ./node\_modules/meshcentral/meshctrl
32
+```
33
+
34
+In this case, when the above command is run without parameters, you should see something like this:
35
+
36
+```
37
+MeshCtrl performs command line actions on a MeshCentral server.
38
+Information at: https://meshcommander.com/meshcentral
39
+No action specified, use MeshCtrl like this:
40
+
41
+ meshctrl [action] [arguments]
42
+
43
+Supported actions:
44
+ Help [action] - Get help on an action.
45
+ ServerInfo - Show server information.
46
+ UserInfo - Show user information.
47
+ ListUsers - List user accounts.
48
+ ListDevices - List devices.
49
+ ListDeviceGroups - List device groups.
50
+ ListUsersOfDeviceGroup - List the users in a device group.
51
+ AddUser - Create a new user account.
52
+ RemoveUser - Delete a user account.
53
+ AddDeviceGroup - Create a new device group.
54
+ RemoveDeviceGroup - Delete a device group.
55
+ AddUserToDeviceGroup - Add a user to a device group.
56
+ RemoveUserFromDeviceGroup - Remove a user from a device group.
57
+ SendInviteEmail - Send an agent install invitation email.
58
+ Broadcast - Display a message to all online users.
59
+
60
+Supported login arguments:
61
+ --url [wss://server] - Server url, wss://localhost:443 is default.
62
+ --loginuser [username] - Login username, admin is default.
63
+ --loginpass [password] - Login password.
64
+ --token [number] - 2nd factor authentication token.
65
+ --loginkey [hex] - Server login key in hex.
66
+ --loginkeyfile [file] - File containing server login key in hex.
67
+ --domain [domainid] - Domain id, default is empty.
68
+```
69
+
70
+This indicated you have a good version of MeshCentral with support for MeshCtrl. MeshCentral and MeshCtrl will be updated together, so as changes are made to the server, MeshCtrl will also be updated to match.
71
+
72
+The next step is to login to the server with MeshCtrl before we can start performing commands. For this document, we will assume we are connection to the local MeshCentral server on port 443 using TLS. For connecting to a different server, use the --url argument to set a different server.
73
+
74
+## Login
75
+
76
+There are two ways to login to MeshCentral using MeshCtrl. You can use the normal username/password, or use a login key. In this section we look at both.
77
+
78
+### Login using username & password
79
+
80
+This is the easiest way to login and start issuing commands is to login using a username and password.
81
+
82
+
83
+
84
+You do this by using the "loginuser" and "loginpass" argument like this:
85
+
86
+```
87
+node ./node_modules/meshcentral/meshctrl serverinfo --loginuser "admin" --loginpass "mypassword"
88
+```
89
+
90
+In this example we are trying to run the “serverinfo” command using the “admin” user and “mypassword” as the password. Because “admin” if the default username for MeshCtrl, you can omit it and just type:
91
+
92
+```
93
+Authentication token required, use --token [number].
94
+```
95
+
96
+In this case, you need to use the Google Authenticator application or a similar application to enter your time based second factor like this:
97
+
98
+```
99
+node ./node_modules/meshcentral/meshctrl serverinfo --loginpass "mypassword" –token 123456
100
+```
101
+
102
+Once the command is run successfully, you should see a response like this:
103
+
104
+```
105
+name: devbox.meshcentral.com
106
+mpsname: devbox.meshcentral.com
107
+mpsport: 4433
108
+port: 443
109
+emailcheck: true
110
+domainauth: false
111
+tlshash: E7A41E1A56D8D716F7D7729B876E48693F2D19C4761F22B1…
112
+https: true
113
+redirport: 80
114
+```
115
+
116
+This is a typical response for the “serverinfo” command and a good way to test that everything is working as expected.
117
+
118
+### Login using the server login key
119
+
120
+This technique needs some setup, but allows MeshCtrl to login as any account without knowing the password of the account, making it very powerful. Care must be taken when doing this and it’s recommended to only be done on the local server itself unless you know when you are doing.
121
+
122
+
123
+
124
+In this technique, we will get a special encryption key from the server and use this to generate a login token to the server. First, we must activate the login token feature of the server by setting “AllowLoginToken” to “true” in the “settings” section of config.json:
125
+
126
+```
127
+{
128
+ "settings": {
129
+ "Port": 443,
130
+ "AllowLoginToken": true
131
+ }
132
+}
133
+```
134
+
135
+Then run the MeshCentral server with the --logintokenkey parameter, you should see something like this:
136
+
137
+```
138
+node ./node_modules/meshcentral --logintokenkey
139
+f3bd69a08a2dde4a3423bec8f20d8626b1e6365381f2d9919e7dfe256ace9cbbdea66bed2bdcd00b71eea9d7c727cb6eb37f3148c0c2d240d5ed44c8f3f6795a479c949159dad366571fea4db7f31c24
140
+```
141
+
142
+The hex value presented here is a sensitive secret that allows anyone to create login tokens that can be used for user impersonation. This key is used when MeshCentral does server peering and load balancing for example. You should save this key in a file, for example “key.txt”, you can do it like this:
143
+
144
+```
145
+node ./node_modules/meshcentral –logintokenkey > key.txt
146
+```
147
+
148
+Now that you have the server key, you can use MeshCtrl like this:
149
+
150
+```
151
+node ./node_modules/meshcentral/meshctrl serverinfo –-loginkeyfile key.txt --loginuser admin
152
+```
153
+
154
+Instead of using a password, we use the key file instead. MeshCtrl will generate a time limited cookie and use that to login as “admin”. Since “admin” is the default username for MeshCtrl, we can omit this parameter:
155
+
156
+```
157
+node ./node_modules/meshcentral/meshctrl serverinfo –-loginkeyfile key.txt
158
+```
159
+
160
+Like the username and password example above, the result will be the server information we requested. Something like this:
161
+
162
+```
163
+name: devbox.meshcentral.com
164
+mpsname: devbox.meshcentral.com
165
+mpsport: 4433
166
+port: 443
167
+emailcheck: true
168
+domainauth: false
169
+tlshash: E7A41E1A56D8D716F7D7729B876E48693F2D19C4761F22B1…
170
+https: true
171
+redirport: 80
172
+```
173
+
174
+### Login into a different domain
175
+
176
+So far, we have seen how to login to a MeshCentral server using a username/password or username/key technique for the default domain. MeshCentral supports many domains at once with each of the domain having its own set of users, groups and administrators.
177
+
178
+
179
+
180
+To do this, using the username and password, we have to tell MeshCtrl to login using the URL that would be used to access that domain, for example:
181
+
182
+```
183
+node ./node_modules/meshcentral/meshctrl serverinfo --url wss://server/domainname --loginuser "admin" --loginpass "mypassword"
184
+```
185
+
186
+or for servers have a DNS name for a domain:
187
+
188
+```
189
+node ./node_modules/meshcentral/meshctrl serverinfo --url wss://domainname.server --loginuser "admin" --loginpass "mypassword"
190
+```
191
+
192
+Note the "--url" argument is different and so, the server will see MeshCtrl access the server using a different domain.
193
+
194
+Doing a domain login using the login is key file is a bit different. We need to specify both the url to access that domain and specify the domain name explicitly using the --domain argument. For example:
195
+
196
+```
197
+node ./node_modules/meshcentral/meshctrl serverinfo –-loginkeyfile key.txt --url wss://server/domainname --domain mycustomer
198
+```
199
+
200
+So, we add both the url to access the correct domain and the domain name explicitly. The domain name must be exactly the one that is used in the domain section of the config.json for of MeshCentral. For example, if the MeshCentral config.json file looks like this:
201
+
202
+```
203
+{
204
+ "settings": {
205
+ "Cert": "myserver.com",
206
+ "Port": 443
207
+ },
208
+ "domains": {
209
+ "": {
210
+ "title": "Default domain",
211
+ },
212
+ "customer1": {
213
+ "dns": "c1.myserver.com",
214
+ "title": "Customer1 domain",
215
+ }
216
+ }
217
+}
218
+```
219
+
220
+The domain login for MeshCtrl with a key file would look like this:
221
+
222
+```
223
+node ./node_modules/meshcentral/meshctrl serverinfo –-loginkeyfile key.txt --url wss://c1.myserver.com --domain customer1
224
+```
225
+
226
+In the next section, we start making use of MeshCtrl to do useful things on the server. From now on, we will omit the login arguments, but note that they are required for all commands.
227
+
228
+## Making use of MeshCtrl
229
+
230
+We can start doing useful operations with MeshCtrl. The current list of operations are:
231
+
232
+```
233
+ServerInfo - Show server information.
234
+ UserInfo - Show user information.
235
+ ListUsers - List user accounts.
236
+ ListDevices - List devices.
237
+ ListDeviceGroups - List device groups.
238
+ ListUsersOfDeviceGroup - List the users in a device group.
239
+ AddUser - Create a new user account.
240
+ RemoveUser - Delete a user account.
241
+ AddDeviceGroup - Create a new device group.
242
+ RemoveDeviceGroup - Delete a device group.
243
+ AddUserToDeviceGroup - Add a user to a device group.
244
+ RemoveUserFromDeviceGroup - Remove a user from a device group.
245
+ SendInviteEmail - Send an agent install invitation email.
246
+ Broadcast - Display a message to all online users.
247
+```
248
+
249
+You can get this list by just running MeshCtrl without any argument and can get more information on each action by typing “meshctrl help [action]”
250
+
251
+### Gathering information
252
+
253
+The following commands are really easy to use: serverinfo, userinfo, listusers, listdevices, listdevicegroups. They just request information from the server. Note that for these commands, you can optionally use “--json" to receive the response in JSON format. For example, getting the list of users will look like this:
254
+
255
+```
256
+node meshctrl.js listusers
257
+id, name, email
258
+---------------
259
+"admin", "admin", "ylian.saint-hilaire@intel.com"
260
+"joe", "joe", "joe@intel.com"
261
+"mytestuser", "MyTestUser", "a@a.com"
262
+"test.user", "test.user", "test.user@user.com"
263
+```
264
+
265
+In the --json argument is used, it looks like this:
266
+
267
+```
268
+node meshctrl.js listusers --json
269
+ {
270
+ "_id": "user//admin",
271
+ "name": "admin",
272
+ "creation": 1417814230,
273
+ "siteadmin": 4294967295,
274
+ …
275
+```
276
+
277
+The JSON version is much long and contain much more information. This format can be useful if you take the output of MeshCtrl and dump it into a file for later parsing. One really useful command is “listdevices” that just displays all the devices in the account grouped by device groups. For example:
278
+
279
+```
280
+node meshctrl listdevices
281
+
282
+Device group: "Lab Computers"
283
+id, name, icon, conn, pwr, ip
284
+-----------------------------
285
+p3HOhDapgT@VyO$upGJYxEa$v4YCY76Y2G@hOGmJnbPXjkSHP@AgJ1M6FkqSEUqg, "raspberrypi", 5, 1, 1
286
+yjbMXlQBf09TSIqKlkwrRucm767TcXfNbSinQWXgpdBBY5MEU1gg0kzshwiwFCOp, "tinkerboard", 5, 1, 1
287
+DRvCLkYIgk744tqqMr9Xvy5TK8aXkLoOXUQETnFdFepVQojyFV5gaBi5Gh4f6B6d, "LattePanda", 5, 1, 1
288
+ggifepc5wqK7sCVnOIjOZy9i9kaJizalIarz7Qwe5bJ4icpLD69zWYpjAaU@sfY$, "MeshLabTop", 1, 5, 1
289
+ECAI7NO893JoN3ntK7@mbniyDq0qriG82wqGKQF4s8SpXs3NdnvuHR76Bzq14Pik, "MeshLabRight", 1, 1, 1
290
+fCLFeHaxQ$T6mgICdVkCdkifiU8LNJdU73YknmxfAb@0jBF2BrhTsEIBwgpoCNx$, "DevLinux", 1, 1, 1
291
+hfbJ7zAgwZK@LQfsZkr1cqTSp6mjjZ3MjGC$v4X8E7HM1cZEnlGBgcorELu1hZWe, "AmtMachine11", 1, 1, 1
292
+YRGm4AQVRR38Ypisuo40KhvBGhDl2pE5YCp4j4eIbLaX3kmH3tmumOUbxb44A@Rh, "CoffeeTable", 1, 1, 1
293
+PpMJiPxtjRjfoEal$9RHdm5s31BaqDSbGc3329s49rzcXcVuTDvm4VO0YllO5XR7, "DevBox", 1, 0, 0
294
+tyR7l2j5@wOjDeRbOQNfjU7xB$ss6VZQPDkFsALPzJ4zbTI4IamV$OdwHeqiXV0K, "MeshLabLeft", 1, 5, 1
295
+i@BNTAHB5NMtDyrHMiCaz3GzYlJUUQn7qZZfh@N6271DWAM3EH6ujRNPc2snGXYX, "raspberrypi", 5, 1, 1
296
+2E$CjXw2Aldh3DGAzSNo5qTSgEhd4OTWcO9KGBi9ja4EOxEUHq8J1135Y2IvxOlX, "AmtMachine7", 1, 5, 1
297
+0Ab3O@4fgHjwVOpC0qaARfURTtKCa@QjxWPDpT5WQ0Wz5s4OvRWAgeoGT9j8k5JF, "RaspberryPi", 5, 1, 1
298
+
299
+Device group: "IntelAMT only"
300
+id, name, icon, conn, pwr, ip
301
+-----------------------------
302
+LN8qsH634RGjDwATIOd3ICzfKrB@t@ERow8AEyDndyAs3yqwfrfhEaMPABMg53cg, "AmtMachine7", 0, 0, 0
303
+Ea3GcF$EoMnDEc9Tbz$Vu9wnmTziqqcOZ0URSdYeuVn4LU9LLMT@91P5s1WLSgVA, "DevBox", 0, 0, 0
304
+```
305
+
306
+It’s also possible to list only the display the list of devices for a single group. Just add --id followed by the group identifier. You can find the group identifier using the “DeisplayDeviceGroups” command. For example:
307
+
308
+```
309
+node meshctrl listdevices --id 7b4b43cdad850135f36ab31124b52e47c167fba055…
310
+
311
+id, name, icon, conn, pwr, ip
312
+-----------------------------
313
+p3HOhDapgT@VyO$upGJYxEa$v4YCY76Y2G@hOGmJnbPXjkSHP@AgJ1M6FkqSEUqg, "raspberrypi", 5, 1, 1
314
+yjbMXlQBf09TSIqKlkwrRucm767TcXfNbSinQWXgpdBBY5MEU1gg0kzshwiwFCOp, "tinkerboard", 5, 1, 1
315
+DRvCLkYIgk744tqqMr9Xvy5TK8aXkLoOXUQETnFdFepVQojyFV5gaBi5Gh4f6B6d, "LattePanda", 5, 1, 1
316
+ggifepc5wqK7sCVnOIjOZy9i9kaJizalIarz7Qwe5bJ4icpLD69zWYpjAaU@sfY$, "MeshLabTop", 1, 5, 1
317
+ECAI7NO893JoN3ntK7@mbniyDq0qriG82wqGKQF4s8SpXs3NdnvuHR76Bzq14Pik, "MeshLabRight", 1, 1, 1
318
+fCLFeHaxQ$T6mgICdVkCdkifiU8LNJdU73YknmxfAb@0jBF2BrhTsEIBwgpoCNx$, "DevLinux", 1, 1, 1
319
+hfbJ7zAgwZK@LQfsZkr1cqTSp6mjjZ3MjGC$v4X8E7HM1cZEnlGBgcorELu1hZWe, "AmtMachine11", 1, 1, 1
320
+YRGm4AQVRR38Ypisuo40KhvBGhDl2pE5YCp4j4eIbLaX3kmH3tmumOUbxb44A@Rh, "CoffeeTable", 1, 1, 1
321
+PpMJiPxtjRjfoEal$9RHdm5s31BaqDSbGc3329s49rzcXcVuTDvm4VO0YllO5XR7, "DevBox", 1, 0, 0
322
+tyR7l2j5@wOjDeRbOQNfjU7xB$ss6VZQPDkFsALPzJ4zbTI4IamV$OdwHeqiXV0K, "MeshLabLeft", 1, 5, 1
323
+i@BNTAHB5NMtDyrHMiCaz3GzYlJUUQn7qZZfh@N6271DWAM3EH6ujRNPc2snGXYX, "raspberrypi", 5, 1, 1
324
+2E$CjXw2Aldh3DGAzSNo5qTSgEhd4OTWcO9KGBi9ja4EOxEUHq8J1135Y2IvxOlX, "AmtMachine7", 1, 5, 1
325
+0Ab3O@4fgHjwVOpC0qaARfURTtKCa@QjxWPDpT5WQ0Wz5s4OvRWAgeoGT9j8k5JF, "RaspberryPi", 5, 1, 1
326
+```
327
+
328
+You can also add “--count" to just return the number of devices instead of displaying them. An example of this would be:
329
+
330
+```
331
+node meshctrl listdevices --id 7b4b43cdad850135f36ab31124b52e47c167fba055… --count
332
+13
333
+```
334
+
335
+Here we see that in a specific device group, there are 13 devices.
336
+
337
+### Adding and removing accounts
338
+
339
+MeshCtrl can be used to add and remove user accounts. This is great is you want to automate MeshCentral in some situations. Normally, an administrator can go to the “My Users” tab and press “New Account…” button to create a new account.
340
+
341
+
342
+
343
+With MeshCtrl the same process can be accomplished using the following command line:
344
+
345
+```
346
+node ./node_modules/meshcentral/meshctrl adduser --user SampleUser --pass SamplePassword
347
+```
348
+
349
+This will create a basic user account with the specified “SampleUser” username and “SamplePassword” password. In addition to the basic example above, there are plenty of additional arguments that can be used. There is a list:
350
+
351
+```
352
+--email [email] - New account email address.
353
+--emailverified - New account email is verified.
354
+--resetpass - Request password reset on next login.
355
+--siteadmin - Create the account as full site administrator.
356
+--manageusers - Allow this account to manage server users.
357
+--fileaccess - Allow this account to store server files.
358
+--serverupdate - Allow this account to update the server.
359
+--locked - This account will be locked.
360
+--nonewgroups - Account will not be allowed to create device groups
361
+--notools - Account not see MeshCMD download links.
362
+```
363
+
364
+Instead of specifying a password, one can specify “--randompass" to have MeshCtrl generate a random password, this is typically use along with “--resetpass" and “--email" to cause the user to perform a password reset the first time a login occurs.
365
+
366
+The permission arguments are used to grant server permissions to the new account. The “-- siteadmin" argument will grant this account full site administrator rights and all other permission arguments are ignored. The other permission arguments can be combined.
367
+
368
+To remove a user account, use the following command:
369
+
370
+```
371
+node ./node_modules/meshcentral/meshctrl removeuser --userid SampleId
372
+```
373
+
374
+Note that when creating a new user, the username is passed in. However, when removing a user account, the userid is used. One can get the list of userid’s by using the “ListUsers” command.
375
+
376
+MeshCtrl will return “ok” if the command is successful and the account will be added in real-time to the “My Users” tab on the website.
377
+
378
+### Creating and removing device groups
379
+
380
+MeshCtrl can be used to add and remove device groups. When a group is created, it’s added in the account that MeshCtrl is logged into and that account gets full rights over that device group. Typically, a new device group is created using the “Add Device Group” link in the main website.
381
+
382
+
383
+
384
+A group has a name, type and optionally a description text. To add a device group using MeshCtrl, we use the “AddDeviceGroup” command like this:
385
+
386
+```
387
+node ./node_modules/meshcentral/meshctrl adddevicegroup --name "Sample group name" --desc "Sample description"
388
+```
389
+
390
+Here we specify the name and description of the new device group. This will create a normal device group that requires agents to be installed on each computer. You can also create an agent-less Intel AMT device group by adding the "--amtonly" argument. Once done, MeshCtrl will return “ok" and the group will be created in the logged in account in real-time.
391
+
392
+You can delete a group by using the “RemoveDeviceGroup” command like this:
393
+
394
+```
395
+node ./node_modules/meshcentral/meshctrl removedevicegroup --id 7b4b43cd…dc89fe0e581c
396
+```
397
+
398
+To remove a device group, the group identifier needs to be specified. You can get that identifier using the "ListDeviceGroups" command. For device groups, the group identifier is a long hex value.
399
+
400
+### Adding and removing users from device groups
401
+
402
+Once you created user account and device groups, the next important operation is to connect the two and grant users access to some device groups. In the web interface, this is typically done by clicking on a device group and managing the users in that page.
403
+
404
+
405
+
406
+To do this, you first have to get the user and group identifiers. You can get these using the “listusers” and “listdevicegroups” commands. Then, you can for example do this:
407
+
408
+```
409
+node ./node_modules/meshcentral/meshctrl addusertodevicegroup --id 7b4b43cd…dc89fe0e581c --userid bob --fullrights
410
+```
411
+
412
+Typically, the group identifier is a long hex value. The command will add user “bob” to a given group with full rights. You can also add a user to a group with only some rights, the list is as follows:
413
+
414
+```
415
+ --fullrights - Allow full rights over this device group.
416
+ --editgroup - Allow the user to edit group information.
417
+ --manageusers - Allow the user to add/remove users.
418
+ --managedevices - Allow the user to edit device information.
419
+ --remotecontrol - Allow device remote control operations.
420
+ --agentconsole - Allow agent console operations.
421
+ --serverfiles - Allow access to group server files.
422
+ --wakedevices - Allow device wake operation.
423
+ --notes - Allow editing of device notes.
424
+ --desktopviewonly - Restrict user to view-only remote desktop.
425
+ --limiteddesktop - Limit remote desktop keys.
426
+ --noterminal - Hide the terminal tab from this user.
427
+ --nofiles - Hide the files tab from this user.
428
+ --noamt - Hide the Intel AMT tab from this user.
429
+```
430
+
431
+Note that if “fullrights” are granted, all other access right arguments are ignored. If successful, MeshCtrl will display “ok”, otherwise it will show an error message.
432
+
433
+To remove a user from a group, use the “removeuserfromdevicegroup” command. For example:
434
+
435
+```
436
+node ./node_modules/meshcentral/meshctrl removeuserfromdevicegroup --id 7b4b43cd…dc89fe0e581c --userid bob
437
+```
438
+
439
+The syntax of this command is identical to the “addusertodevicegroup” command, but there are no rights arguments. MeshCtrl will also display “ok” if the command got processed correctly.
440
+
441
+### Message Broadcast
442
+
443
+One fun command the MeshCtrl offers is the “broadcast” command. It sends a short notification message that all connected users will see in real-time. For example, you can do this:
444
+
445
+```
446
+node ./node\_modules/meshcentral/meshctrl broadcast --msg "This is a test"
447
+```
448
+
449
+All connected users will see this:
450
+
451
+
452
+
453
+The broadcast command is great for notifying users of upcoming server downtime or other events.
454
+
455
+## Conclusion
456
+
457
+MeshCtrl is an essential tools in every MeshCentral administrator’s tool box. It allows administrators to automate various MeshCentral management tasks which can be useful for large scale management of many devices and users.
458
+
459
+## License
460
+
461
+MeshCtrl and this document are both opens source and licensed using Apache 2.0, the full license can be found at [https://www.apache.org/licenses/LICENSE-2.0](https://www.apache.org/licenses/LICENSE-2.0)