Installing ElasticAgent with GPO

kotvmrc
Tue, 12 Apr 2022 14:49:54 +0000
Endpoint Security

Hi all,

I'm looking for installing elastic-agent 7.16 on several Windows PCs with a GPO, EPs could be too many to install it manually.

I can't find any guide to do it, so I tried to do it by myself creating a Powershell script to run with a Startup/Logon Script GPO

My problem is that the installation seems to work and the C:\Program Files\Elastic\Agent folder is created at the end of the process, but the agent doesn't enroll to the fleet server and the C:\Program Files\Elastic\Agent\elastic-agent.exe symlink is not present,
meanwhile is present the "C:\Program Files\Elastic\Agent\data\elastic-agent-d420cc\elastic-agent.exe" file.

I paste here the powershell script I created to deploy the agent. Can anybody help me? Somebody had installed the elastic agent massively on domain joined windows PCs?

	#Using Powershell 5.0+

$file = '.\Elastic\Agent\elastic-agent.exe'
Set-Location $Env:ProgramFiles

if (-not (Test-Path -Path $file)) {

		Set-Location $Env:TEMP
		#Uncomment (this ↓) line if you need to download the zip file and comment the Copy-Item line
		# Invoke-WebRequest https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.16.3-windows-x86_64.zip -OutFile elastic-agent-7.16.3.zip
		Copy-Item "\\domaincontroller.local\SYSVOL\domaincontroller.local\scripts\Elastic\elastic-agent-7.16.3.zip" .\elastic-agent-7.16.3.zip
		Start-Sleep -s 15 #sleep to ensure previous job was completed
		Expand-Archive .\elastic-agent-7.16.3.zip -DestinationPath .
		Start-Sleep -s 5  #sleep to ensure previous job was completed
		Set-Location .\elastic-agent-7.16.3-windows-x86_64
		start-process -FilePath ".\elastic-agent.exe" -ArgumentList "install", "--url=https://fleet.domain.tld:port", "--enrollment-token=my_token", "--insecure", "--force" -Wait
			#↑ same as .\elastic-agent.exe install --url=https://fleet.domain.tld:port --enrollment-token=my_token --insecure --force
		Start-Sleep -s 10  #sleep to ensure previous job was completed
		#Removing files no more needed
		Set-Location ..
		Remove-Item .\elastic-agent-7.16.3.zip
		Remove-Item .\elastic-agent-7.16.3-windows-x86_64 -Recurse

	}

else {

	exit

}

7 posts - 4 participants