# Installing Elastic Agent with GPO **URL:** \ **Category:** Endpoint Security\ **Created:** [August 9, 2024, 9:30am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659 "2024-08-09T09:30:20Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 9, 2024, 9:30am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/1 "2024-08-09T09:30:20Z")
Im looking to deploy Elastic Agent via a GPO. What is the best way to do it? It should autoenroll onto Fleet without any manual token needed ---
**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\ **Post date:** [August 9, 2024, 10:12am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/2 "2024-08-09T10:12:26Z")
I think the msi is what you're looking for [Install Elastic Agent from an MSI package | Fleet and Elastic Agent Guide [8.15] | Elastic](https://www.elastic.co/guide/en/fleet/current/install-agent-msi.html) ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 9, 2024, 10:15am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/3 "2024-08-09T10:15:31Z")
Several questions: 1: Is some kind of autoenrollement supported? Where I do not have to provide a token? 2: Can I upgrade/update thru Fleet even if the first time I install it thru MSI? Thank you ---
**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\ **Post date:** [August 9, 2024, 10:56am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/4 "2024-08-09T10:56:24Z")
1: No. Perhaps you can deploy Agents, let them sit dormant initially, then enroll them from command line via other means [Elastic Agent command reference | Fleet and Elastic Agent Guide [8.15] | Elastic](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html#elastic-agent-enroll-command) 2: That's what the documentation implies. I haven't tried it yet myself nor developed the MSI. [Install Elastic Agent from an MSI package | Fleet and Elastic Agent Guide [8.15] | Elastic](https://www.elastic.co/guide/en/fleet/current/install-agent-msi.html#_upgrading) ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 9, 2024, 10:59am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/5 "2024-08-09T10:59:52Z")
> [@lesio](#): > > 1: No. > > Perhaps you can deploy Agents, let them sit dormant initially, then enroll them from command line via other means Yeah, thats not gonna work. I need to silently and automatically enroll them > [@lesio](#): > > 2: That's what the documentation implies. I haven't tried it yet myself nor developed the MSI. > > [Install Elastic Agent from an MSI package | Fleet and Elastic Agent Guide [8.15] | Elastic](https://www.elastic.co/guide/en/fleet/current/install-agent-msi.html#_upgrading) Yeah, it seemed weird Fleet could manage them but ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 9, 2024, 11:24am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/6 "2024-08-09T11:24:13Z")
For example: Start-Process -FilePath "msiexec.exe" -ArgumentList '/i', 'elastic-agent-8.13.4-windows-x86\_64.msi', 'INSTALLARGS="--url=[http://fleetserver.domain.local:8220](http://fleetserver.domain.local:8220) --enrollment-token=VnJKUUlwRUJHNlRB30Jjb3M4TzIfbW52L2lNZaFRNbJq2lA41m9vq0MWZw== --insecure --force"', '/quiet', '/norestart', '-L\*V', 'elasticlog.txt' -Wait -NoNewWindow Running that, makes the folders but no data/agent/services/files/etc. Looking at the log doesnt show anything except that it cannot be enrolled. ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [August 9, 2024, 4:01pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/7 "2024-08-09T16:01:32Z")
> [@riahc3](#): > > Running that, makes the folders but no data/agent/services/files/etc I was able to reproduce something similar by disconnecting the NIC, breaking Agent's ability to enroll. ```auto PS C:\Users\user\Desktop> $ARGLIST = @( >> '/i', >> 'elastic-agent-8.13.4-windows-x86_64.msi', >> 'INSTALLARGS="--url=URL --enrollment-token=TOKEN --insecure --force"', >> '/quiet', >> '/norestart', >> '/l*v', 'elasticlog.txt' >> ) PS C:\Users\user\Desktop> Start-Process "C:\Windows\System32\msiexec.exe" $ARGLIST -Wait -NoNewWindow PS C:\Users\user\Desktop> Get-Process elastic-agent Get-Process : Cannot find a process with the name "elastic-agent". Verify the process name and call the cmdlet again. At line:1 char:1 + Get-Process elastic-agent + ~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : ObjectNotFound: (elastic-agent:String) [Get-Process], ProcessCommandException + FullyQualifiedErrorId : NoProcessFoundForGivenName,Microsoft.PowerShell.Commands.GetProcessCommand PS C:\Users\user\Desktop> dir 'C:\Program Files\Elastic\Beats\8.13.4\elastic-agent\' Directory: C:\Program Files\Elastic\Beats\8.13.4\elastic-agent Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 8/9/2024 8:40 AM data -a---- 8/9/2024 8:39 AM 0 fleet.enc.lock ``` If I reconnect the NIC, Agent successfully enrolls and installs: ```auto PS C:\Users\user\Desktop> $ARGLIST = @( >> '/i', >> 'elastic-agent-8.13.4-windows-x86_64.msi', >> 'INSTALLARGS="--url=URL --enrollment-token=TOKEN --insecure --force"', >> '/quiet', >> '/norestart', >> '/l*v', 'elasticlog.txt' >> ) PS C:\Users\user\Desktop> Start-Process "C:\Windows\System32\msiexec.exe" $ARGLIST -Wait -NoNewWindow PS C:\Users\user\Desktop> Get-Process elastic-agent Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 253 22 30988 45272 0.36 10768 0 elastic-agent PS C:\Users\user\Desktop> Get-Process elastic-endpoint Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName ------- ------ ----- ----- ------ -- -- ----------- 513 23 13704 14256 0.31 10292 0 elastic-endpoint ``` Given that, it sounds like you have an issue with Agent enrollment, not an issue specific to the MSI. To simplify your debugging, you could debug the enrollment issue using the [regular 8.13.4 zip](https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.13.4-windows-x86_64.zip). ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [August 9, 2024, 4:49pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/8 "2024-08-09T16:49:27Z")
> [@riahc3](#): > > It should autoenroll onto Fleet without any manual token needed I just created a PowerShell script to embed `INSTALLARGS` into the MSI, giving you another way to achieve this. If you're interested, feel free to give it a try. [Personalize-ElasticAgentMSI.ps1 ยท GitHub](https://gist.github.com/gabriellandau/b838192eefd81fc53816f4e973a026d0) ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [August 13, 2024, 3:20pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/9 "2024-08-13T15:20:28Z")
I would recommend creating an MST via a tool like ORCA to embed the INSTALLARGS property. This will allow customization in a way that is deployable via GPO while retaining the MSI signature. If I have some time I can produce an example w/ instructions ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 21, 2024, 10:55am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/10 "2024-08-21T10:55:53Z")
Yes, if you could, please give a example. I tried it as well with that and nothing. Thank you very much @strawgate ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 21, 2024, 10:59am UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/11 "2024-08-21T10:59:20Z")
Im gonna try this out as well. Thank you ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [August 21, 2024, 2:03pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/12 "2024-08-21T14:03:14Z")
### Running an MSI with an MST by command line: `msiexec /i elastic-agent-8.15.0-windows-x86_64.msi /qb TRANSFORMS="enroll-elastic-agent.mst"` ### Applying an MST with installing an MSI via GPO In the GPO, under the modifications tab, add the MST to have Windows apply the MST during MSI installation. ### Making an MST Download ORCA [Orca.exe - Win32 apps | Microsoft Learn](https://learn.microsoft.com/en-us/windows/win32/msi/orca-exe) and open the MSI with ORCA. At the top press, `Transform` and then `New Transform`. Navigate to the `Property` table on the left-hand side of ORCA: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/a/ea20bb5a4fa7901ef1844a2b13cc364951ab7272.jpeg) Right click on the right hand side and press `Add Row` and set the Property to `INSTALLARGS` and the Value to your installation arguments: ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/7/f7b3d43cf1de024fa7a56f890a6ac9f47122e353.jpeg) and press `OK`. Now at the top press `Transform` and then `Generate Transform`, save the MST and close ORCA. ### Notes Installation of the MSI will fail if the Fleet server cannot be reached or enrollment fails during installation. You can add `--delay-enroll` to the INSTALLARGS to separate installation from enrollment though enrollment may not proceed until the service is manually started or the system is rebooted. ---
**Author:** ![gabriel.landau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabriel.landau/32/73401_2.png) [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)\ **Post date:** [August 21, 2024, 2:27pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/13 "2024-08-21T14:27:09Z")
> [@riahc3](#): > > I tried it as well with that and nothing. You may have missed this comment at the bottom of a prior post: > [@gabriel.landau](#): > > Given that, it sounds like you have an issue with Agent enrollment, not an issue specific to the MSI. To simplify your debugging, you could debug the enrollment issue using the [regular 8.13.4 zip](https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.13.4-windows-x86_64.zip). ---
**Author:** ![riahc3](https://avatars.discourse-cdn.com/v4/letter/r/d6d6ee/32.png) [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Post date:** [August 22, 2024, 12:03pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/14 "2024-08-22T12:03:35Z")
I tried with this one editing Property and adding INSTALLARGS with these (example) values and it worked pretty fine: --url=[https://thenameofserver:8220](https://thenameofserver:8220) --enrollment-token=ksjdfgsdfgfdgdsfgfdsgfdsgsfdgfdsgsfdgfdsgsfdgsfdgsdfgdfdgvvvvvvvfZw== --insecure --delay-enroll There are a couple of gotchas to this: If you reploy software via GPO, later there is issues with reinstallation. 1: Run the MSI manually. It will say to remove the Elastic Agent. Remove it. 2: SOMETIMES the service stays installed. Stop the service and remove it via cmd as admin: sc remove "Elastic Agent" 3: Same thing with the installation files. Go to C:\Program Files\Elastic and just delete the folder of Elastic 4: In regedit, go to HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt you should have a key, that references to Elastic Agent. Delete the entire key. 5: Run a gpupdate /force and it will ask you to reboot. 6: After this, look at services. Elastic Agent should be present. 7: Reboot again. Once you reboot, the Elastic Agent service should start up (at this point, you can start it manually as well if you want) and it should register with Fleet. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 19, 2024, 12:04pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/15 "2024-09-19T12:04:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.