topic Automate deployment of secure endpoint? in Endpoint Security

Automate deployment of secure endpoint?

rubdeadman — Wed, 16 Feb 2022 22:41:01 GMT

Hello all,

Does anyone have suggestions for the best way to automate the installation of secure endpoint to end devices?

Have a large deployment and trying to find solutions to simplify it. The environment will be a mix of Windows and Mac.

Any resource or ideas would be great.

Thanks!

Re: Automate deployment of secure endpoint?

Ken Stieers — Tue, 01 Mar 2022 04:07:20 GMT

Use whatever normal deployment you use for other software... we use a task sequence in our build process and then do upgrades from the endpoint console. The one twist we have is that Orbital, which is pulled down by Secure Endpoint. The download and the Task Sequence don't play well, so we deploy to a group that doesn't have orbital and move the machines over later via an API call.

Re: Automate deployment of secure endpoint?

soup_dragon — Tue, 01 Mar 2022 14:05:52 GMT

As Ken said use whatever you use now. One tip is if that is part of a build image make sure you use the switch /goldenimage 1. This prevents Endpoint from registering. If you this is not used you will end up with multiple machines with the same GUID which will cause a load of issues. I know this from first hand experience 😉

Whole bunch of info here on the Cisco site regarding command line switches.

While I am here there is a Best Practices guide for Endpoint can be found here

Both of the links above open in a new page/tab

If you are looking for an automated tool for installation of software then suggest a look at automox.com, can be used to install software as well as patching.

Re: Automate deployment of secure endpoint?

MavDuncan — Tue, 01 Mar 2022 14:33:34 GMT

I was able to wrap the .exe with a tool called MSI Wrapper. From there I used PowerShell to deploy the .MSI across 200 servers. It took about an hour roughly for them to all report in. You can put whatever flags you need into the MSI tool.

The script relies on an array file that lists what servers you are targeting. Basically a .CSV with the FQDN's of each server.

Here is the script:

$file = '\\*Server*\*Share*\AmpConnector.msi'
$computers = Get-Content C:\Users\*yourUserName*\Desktop\array1.csv

foreach($computer in $computers){
Copy-Item -Path $file -Destination "\\$computer\c$\windows\temp\AmpConnector.msi"

Invoke-Command -ComputerName $computer -ScriptBlock{
&cmd.exe /c MSIEXEC /I "c:\windows\temp\AmpConnector.msi"
}
Write-Host($computer + "install is completed.")
}

Re: Automate deployment of secure endpoint?

Ken Stieers — Tue, 01 Mar 2022 15:08:20 GMT

I mean at that point (as an MSI) you can do it via GPO.