Automatic Deployment of Endpoint Clients

Overview

Software deployment rules are supported for Windows, macOS and Linux. Use deployment rules to automatically download and install pre-configured packages on endpoint devices.

To manage your Endpoint Security clients and install Endpoint Security Policy on them, you must first deploy the Initial Client to them. The Initial Client is the Endpoint Agent that communicates with the Endpoint Security Management Server.

Automatic Deployment of Endpoint Clients Using the Tiny Agent

The Tiny Agent is supported with Windows, macOS, and Linux. It is an enhancement to the current Initial Client package (which is a very thin client, without any blade, used for software deployment purposes). The Initial Client is the Endpoint Agent that communicates with the Endpoint Security Management Server.

You can extract the Initial Client from the Tiny Agent. The improvements include:

• The Tiny Agent has a very small executable (smaller than 1MB).

• Consolidates all the connection parameters in a single executable.

• It can be shared in various forms, enabling fast, easy and seamless first-time deployment.

• Once combined with the Dynamic Package, it installs only what is necessary for each machine.

• It is agnostic to the client version.

• It passes Smart Screen validation - no more download warnings.

• It reduces network traffic for installing selected blades.

To deploy the Endpoint Security Client using the Tiny Agent

Do any one of these:

Method 1 - From the Software Deployment policy

1. Click Policy > Deployment Policy > Software Deployment and then click Download Endpoint on the top banner.

2. Select a Download version and a Virtual group.

3. Do one of these:

   • To download the file immediately, click Download for the relevant OS and transfer the file to the endpoints.

     Table 1. Downloaded files by Client and OS

     Client	OS	Downloaded file
     Endpoint	Windows	EPS_Year_Version.exe
     Endpoint	macOS	EPS_TINY.zip
     Endpoint	Linux	installScript.sh
     Browse	Windows	BrowserSetup.exe
     Browse	macOS	BrowserSetup.zip
     Browse	ChromeOS	BrowserSetup_chromeOS_Laptop.exe or BrowserSetup_chromeOS_Desktop.exe

   • To download the file using a download link, click Copy download link. When the download link is ready, the Send the Link by Email window appears. Click to copy the link. Share the download link with users (for example, by email) to download the file.

Method 2 - From Overview > Getting Started

1. Go to Overview > Getting Started > Let's Start Connect Your First Agent.

2. In the Download & Install Endpoint agent widget, click Download. The Download & Install Endpoint Agent window appears.

3. Click Online Install.

4. From the Operating System list, select the OS.

5. From the Version list, select the client version.

6. For Windows: Run the exe file to install the Endpoint Security client. If you want to use the msi file, then convert the exe file into an msi file:

   1. Open the Command Prompt window by selecting Run as administrator.

   2. Run: cd [Path where you have downloaded the exe file]

      For example, cd C:\\Users\\User\\Downloads

   3. Run: EndpointSetup.exe /CreateMSI

   4. Transfer the msi file to the endpoints and run the msi file to install the Endpoint Security client.

   Note:

   For silent installation, run msiexec.exe /i [path to msi file]\\EPS.msi /qn SILENTINSTALL=1.

7. For macOS: Unzip the file and open the EPS_TINY folder. To install the Endpoint Security client, do one of these:

   • From Finder, double-click the directory EPTiny.app

   • In the terminal window, run: ./EPTiny.app/Contents/MacOS/EPTiny

8. For Linux:

   • If you downloaded the installScript.sh file, run the file on the endpoint to install the Endpoint Security client.

   • If you copy the download link, on the Linux machine, run:

     curl [paste_download_link] -o install.sh
     chmod +x install.sh
     sudo ./install.sh install

9. Continue with Deployment Rules.

Troubleshooting Issues with the Tiny Agent on Windows OS

The Tiny Agent shows simple error messages in cases of network issues (connectivity problems, proxy issue, and so on).

Error messages and Remediation

Log File Location

The log file is located here:

C:\\Windows\\System32\\LogFiles\\WMI\\EndpointSetup.etl

Silent Installation

Run:

PsExec.exe -accepteula -nobanner -s "C:\\Users\\<Administrator Username>\\Desktop\\EndpointSecurity.exe"

Endpoint Security Component Package

This package includes the specified components to be installed on the endpoint device. You can distribute it automatically with deployment rules. You can configure the policies for the components before or after you deploy the component package.

Using the Vanilla Client

The Vanilla client is similar to the Tiny Agent but receives the connection parameters separately that prevents unauthorized clients to connect to the Endpoint Security Management Server.

To deploy the Endpoint Security Client using the Vanilla Client:

1. Go to Overview > Getting Started > Let's Start Connect Your First Agent.

2. In the Download & Install Endpoint agent widget, click Download. The Download & Install Endpoint Agent window appears.

3. Click Copy Installation link.

4. The download link appears in the field on the left. Click to copy the link.

5. Do one of these:

   Table 3. Vanilla Client installation options

   To	Do
   Install the Vanilla client directly on the endpoint	On the endpoint where you want to install the client, open the link in a browser. Note: Make sure that the user has Administrator role in the endpoint. In the Download Endpoint Agent widget, click Download. The system downloads the EndpointSetup.exe file. Run the EndpointSetup.exe to register the client. The Ready to connect dialog box appears. Click OK. In the Connect to Endpoint Security widget, click Connect. The Endpoint Security dialog box appears that shows the client installation status.
   Install the Vanilla client remotely on the endpoint	On the endpoint where you want to install the client, run this command as the Administrator: EndpointSetup.exe /url [link] The system downloads the Vanilla client, installs it and then connects to the Endpoint Security Management Server.
   Install the Vanilla client remotely on the endpoint using third-party distribution applications, for example, Microsoft InTune	Run this command as the Administrator: EndpointSetup.exe /createmsi /url [link] The system downloads the EPS.msi file. Distribute the EPS.msi file using third-party MDM application. For more information, see Remote Installation of Initial Client.

When the installation is complete, the Endpoint Security Client is installed on the endpoint and connected to the Endpoint Security Management Server. Continue with Deployment Rules.

Deployment Rules

Deployment rules let you manage Endpoint Security Component Package deployment and updates. Deployment rules work on both Windows OS and macOS. Linux OS is not supported yet.

The Default Policy rule applies to all Endpoint devices for which no other rule in the Rule Base applies. You can change the default policy as necessary.

You can define more rules to customize the deployment of components to groups of Endpoint devices with different criteria, such as:

• Specific Organizational Units (OUs) and Active Directory nodes.

• Specific computers.

• Specific Endpoint Security Virtual Groups, such as the predefined Virtual Groups (All Laptops, All Desktops, and others). You can also configure your own Virtual Groups.

Deployment rules do not support user objects.

Mixed groups (that include both Windows OS and macOS objects) intersect only with the applicable members in each rule.

To create new deployment rules for automatic deployment

See Installation and Upgrade Settings for local deployment options.