Deploying ThousandEyes Endpoint Agent using Active Directory GPO

[oatroshc]

Welcome to a series of articles about ThousandEyes!

ThousandEyes is a powerful SaaS platform that gives a digital picture of enterprise infrastructure, formed by test views, alerts, dashboards, and other components.

This article describes step-by-step deploying the Endpoint Agent (EPA) using Active Directory GPO.

Prerequisite definitions and testing parameters

Group Policy Objects (GPO) are efficient for deploying large-scale Microsoft Installer packages (MSIs), offering several benefits such as centralized management, ease of updates, automation, scheduled deployment, scalability, consistency, and policy enforcement. 

This was tested in the lab using Windows Server 2019 DC AD as the server and Windows 10 Pro as the client. For the GPO purpose, we will use User Configuration Policies to enforce EPA deployment when a domain user logs on.

With that context, we can review the steps involved at a high level:

Windows Server-side:

• Create a shared resource with the installation MSI file.
• Download the Endpoint MSI and place it into the shared resource.
• Set up Group Policy Objects in Active Directory.

Client-side:

• Ensure the client is a member of the domain.
• Verify that the client has access to the shared folder on the server.
• Confirm that ThousandEyes Endpoint Agent (EPA) is not currently installed on the client, as it will be installed once the GPO is configured and the deployment process is completed.
• Check that the endpoint is visible in the ThousandEyes UI once the installation is finished.

Creating a shared resource and putting the EPA installation there is a straightforward task that involves creating a folder and adjusting its security settings to meet your organization's requirements. The key objective is to ensure this resource is accessible to the clients.

For the purposes of this article, we used the server IP 192.168.2.152 and a shared folder install, which stores the .msi installation file:

So let's get started!

Part 1: Setting up GPO (Windows Server-Side).

Step1: Open Group Policy Management, expand the forest, choose your domain, right click on it and select 'Create a GPO in this domain, and Link it here...':

Step 2: Name it and select "OK" 

We recommend a naming convention that is purpose-driven. In the example we use TE-EPA-MIS - meaning that the policy is forcing TE EPA .msi packet

Step 3: Edit the new Group Policy:

Step 4: Expand User Configuration > Policies > Software Settings. Right-click on Software Installation and select New > Package:

Step 5: Select the package the GPO will use for install:

Step 6: In the dialog that appears select "Assigned". This will push the MSI on the client when the time comes:

Once assigned, it should appear like this:

Double-click on the package and select Properties:

In the pop-up window, go to the Deployment tab and ensure that "Install this application at logon" is selected, as well as "Basic" in the User Interface section:

 

Step 7: Finally, return to the Group Policy Management console, right-click on your domain and choose "Link an existing GPO":

Select the GPO you created and named in Step 2 and choose "OK"

 

Part 2: Moving on to the Client-side PC.

Step 1: Ensure that the PC is a member of the te.com domain and that the network path is visible:

 

Step 2: Sign out and log on again – the ThousandEyes Endpoint should be pulled from the shared folder and installed automatically:

In a few minutes, it should become visible within the ThousandEyes UI:

And that's it - completed!

If you have any issues in the course of your own installation, have questions or need help - please open a chat with ThousandEyes Customer Support, we'll be happy to help! Here is an article on getting in touch with us in only a few seconds.

Reference to useful ThousandEyes resources:

• Main web page: thousandeyes.com
• Install Endpoint Agents for Windows via Group Policy
• Official documentation portal: docs.thousandeyes.com
• Application page: app.thousandeyes.com