---
title: "Agent Rollout via Active Directory Policy"
description: "We are not using .MSI packages since the installation is normally just done when the computer is restarted, which is not always possible for servers."
category: "Knowledge Base"
subcategory: "Collection"
last_updated: "2023-04-06"
source_url: "https://docs.xeox.com/knowledge-base/1tsADjnvsqfNJwHKuwpWZK/agent-rollout-via-active-directory-policy/1w9nBKQA88M2smGbaX5QTn"
---

# Agent Rollout via Active Directory Policy

## Problem:

We don’t use .MSI packages because the installation is normally done when the computer is restarted, which is not always possible for servers.

## Solution:

#### Set up a public distribution share (SMB) to store installation files

We suggest utilizing the active directory NETLOGON share because:

- it is generally accessible across all sites
- it is automatically replicated throughout the domain sites

Alternatively, you may utilize other publicly available network shares (Access Level: read/execute for everyone). Please adjust the following steps to match your domain configuration and distribution share choice.

- Log in as the domain administrator on the domain controller.
- Locate the NETLOGON share (usually the FQDN of your active directory).
- For example, **FQDN: hs2n.local → Netlogon Share: \\hs2n.local\\NETLOGON**
- Create a folder named **XEOX\_Agent**.
- Copy the .exe file downloaded in step 1 to the folder.
- Create a batch file named **XEOX\_agent\_install.bat**.
- Open the new file **XEOX\_agent\_install.bat** with Notepad and enter the following CODE.
- Version 1 (simple; only verifies if at least one agent is installed and installs if none are installed) - Future agent updates will be done over the internet.

**XEOX\_agent\_install.bat**

This BAT file checks if the agent is already installed (**Program Files** contains the **XEOX folder**). If not, it will execute the installer with

- /S for silent installation
- /U do not overwrite later versions upgrades to later versions will be done via XEOX.
- /T for token, you need this in order for the installation to work

```
if exist "%ProgramFiles(x86)%\xeox\version.txt" goto nothing
if exist "%ProgramFiles%\xeox\version.txt" goto nothing
echo Installing XEOX Agent
%~dp0XEOX_Agent_GENERIC_2_1_0_57.exe /S /U /T=[Token*]
echo Install Finished
exit

:nothing
echo XEOX is already installed, doing nothing
```

Adopt the LINE `XEOX_Agent_GENERIC_2_1_0_57.exe /S /U /T=[Token*]` with the .exe file you got in step 1 (make sure that the `%~dp0` and the `/S /U` is not touched).

\* Adopt the token, with the connection key you get while downloading the agent. Copy:

![notion image](https://docs.xeox.com/media/6423bf9556514ab8.png)

Full command example:

```
%~dp0XEOX_Agent_GENERIC_2_1_0_57.exe /S /U /T=EJCRUL5MQZKW72OLHYVX3DUPGTN1IBNFXWRQZTL72YBKMTHZDPIF8KGLR9AX5NQLNV7O3YJSWTQ9BHJZKF2IXGMP1ARW2EVXTXMQBY8TPFSQ7F4YJ3WPEFJLQAT3BHCYMLT2YCV5HBUNJQFIE9MWBCTO43N2ZKDGS8JXLM4NY3DCQBW57H5TUYZ29WFJAKT8RPBSKXDJYUC6MNQUHV35SOYE7W2G6PIUTXB4LFJZM9HDYKRXBE2IP56WS47NQFTHC8MUAJFLRKPZSQN5WTJ84DHEJPKV6IS4X3GOQZ2HMYTWPAKJHURQ3ZXBCP5ELTUKY2NEH5XMWDZVL4ONQYTR3FC58VUBY7JGQTA3JKZLYWX4BEVI9URQ38MFYL6XE5PTNZ2RVM7DSW8QCYJ3GZLKA8X9BPFM45RECHYWJGPKVTU4Q6DYM7WLZFXHPBQNEUTGV3RNY98U6JBDZH24CSOL3QMVX5K7HPI2BXEGWFTYNLV9DRU7FZ4JHTXPA3LGJKB6IYU95Q2W8DMXAVZK4LTSHWQY73FJRYCNXU9PLTEBV2HG53UMKQ
```

The final folder structure should look like this (the .exe filename will be different):

![notion image](https://docs.xeox.com/media/d30979e0280d73de.png)

#### Create a new GPO object with a scheduled task

- Logon with a domain admins to a domain controller.
- Open the **Group Policy Management Console**.
- Create a new Group Policy Object ([https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-a-group-policy-object](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/create-a-group-policy-object)).
- Name it **XEOX Cloud Agent Rollout.**

![notion image](https://docs.xeox.com/media/4b06303348cc98af.png)

- Right-click this newly created GPO and then click **Edit**.
- Expand computer or user configuration and then go to the following path:
- **Preferences -> Control Panel Settings -> Scheduled Tasks**
- Right-click on scheduled tasks and then click **New -> Scheduled Task (Windows Vista and Later)**
- Change the following properties in the tab **General**

![notion image](https://docs.xeox.com/media/30f7de44896953a6.png)

- Tab Trigger

click on **New...** and change the properties

![notion image](https://docs.xeox.com/media/7b8a2612884fdf6d.png)

- Tab Actions

click on **New...** and then **Browse...** and select the .bat file that we have created in step 2 on the NETLOGON Share e.g.

![notion image](https://docs.xeox.com/media/0b083a33cad69d88.png)

- Make sure that you are using an UNC path. Do not use the name of the specific domain controller, but always use the **domain FQDN.**
- e.g. `\\hs2n.local\netlogon\XEOX_Cloud_Agent\XEOX_cloud_agent_install.bat`
- Click **OK** and **Apply**.
- Link the GPO Object to a test OU (organisational unit).
- Wait a few minutes until the GPO objects and links are replicated.
- Execute the update on a computer and check if the scheduled task was created.
- Wait until its executed automatically and manually check if the XEOX cloud agent folders are created on the machine.

### Firewall exceptions

The XEOX cloud agent is communicating via https (port 443) to the XEOX cloud server ([https://login.xeox.com).](https://login.xeox.com%29./) Please configure your local firewall to allow port 443 from all windows client machines to login.xeox.com.

### Verify installation

- Verify that the GP update is working
- Verify that the scheduled task is created by the GPO
- Verify that XEOX cloud agent is created

![notion image](https://docs.xeox.com/media/f039c87d84719c3d.png)

- Login to XEOX cloud console and navigate to **XEOX - Hardware List**

![notion image](https://docs.xeox.com/media/f4d5cebb6c340f1a.png)

- The computers should show up here.