SCCM ThousandEyes Endpoint Agent Deployment using a PowerShell Script

[ahernan4]

• Introduction
• 1. PowerShell Script Creation
• 2. SCCM Application Creation & Configuration
• >2.1 Create the Application
• >2.2 Specify SCCM Application Settings
• >2.3 Configure the PowerShell Script Execution in SCCM
• >2.4 Distribution Settings
• >2.5 Poduct Code Clause (Software Detection)
• >2.6 Verify Content Locations
• 3. Deploy the Application
• Conclusion & Resources

Introduction

There are several methods for deploying the ThousandEyes Endpoint Agent. SCCM is a common, efficient approach for bulk deployment. However, in environments where the standard MSI package deployment is not feasible, a PowerShell script serves as an effective alternative. This script can be configured to include the necessary connection string, TCP driver, and browser extensions (Chrome, Edge) for the designated ThousandEyes account group.

1. PowerShell Script Creation

Create the PowerShell script using the following code. (Make sure to use the .ps1 extension in the file format name)

# ==============================
# Variables
# ==============================
$InstallerPath = "<MSI PATH FILE>" 
$LogPath = "<EXISTING FOLDER PATH FOR LOGS\ThousandEyesInstall.log>”
# This is the Account Group Connection String
$AccountToken = "<YOUR CONNECTION STRING>" 

# ==============================
# Execution
# Do not modify below this line
# ==============================

# 1. Check if the installer exists
if (-not (Test-Path $InstallerPath)) {
    Write-Error "Installer not found at: $InstallerPath"
    exit 1
}

# 2. Build the arguments
# Note: Changed TOKEN to ACCOUNT_CONFIG and added ADDLOCAL features
$Arguments = @(
    "/i `"$InstallerPath`"",
    "ACCOUNT_CONFIG=`"$AccountToken`"",
    "ADDLOCAL=`"ExtendedNetworkTestsSupport,IeExtension,ChromeExtension,EdgeExtension`"",
    "/qn",
    "/norestart",
    "/l*v `"$LogPath`""
)

# 3. Start the MSI installation
try {
    Write-Host "Starting Cisco ThousandEyes installation..."
    $process = Start-Process "msiexec.exe" -ArgumentList $Arguments -Wait -PassThru
    
    if ($process.ExitCode -eq 0 -or $process.ExitCode -eq 3010) {
        Write-Host "Installation completed successfully (Exit Code: $($process.ExitCode))."
    } else {
        Write-Host "Installation failed with Exit Code: $($process.ExitCode)"
        exit $process.ExitCode
    }
} catch {
    Write-Host "An error occurred during execution: $($_.Exception.Message)"
    exit 1
}

 

Make sure to specify the correct variables in the code:

InstallerPath: Path location of the MSI installer (Endpoint agent MSI package)

LogPath: The EXISTING folder for the ThousandEyes logs to be created, example for windows machines: “C:\Windows\Temp\ThousandEyesInstall.log". Important log file to get the Product Code needed in next steps.

AccountToken: This is the connection string that will map the Endpoint Agent to the ThousandEyes account group. The connection string can be found in the ThousandEyes UI under: Endpoint Experience > Agent Settings > Add New Endpoint Agent > Connection String

 

2. SCCM Application Creation & Configuration

We need to create the SCCM application to push the software with the PowerShell script.

>2.1 Create the Application

Inside the Microsoft Configuration Manager and under software management > Applications. Click on “Create Application”.

>2.2 Specify SCCM Application Settings

• In the application “Type”, select “Script installer”. This way we will tell SCCM we will provide the command line ourselves executing the powershell script, which then will trigger the MSI.
  
  
• Location: Browse and point this to the network share containing the .ps1 and .msi location. (Both files must be in the same folder)

Note: It is worth to mention that In SCCM, you do not upload files directly into the console (like you might with a web-based tool). Instead, SCCM uses a Content Source. A folder on a network share that the Site Server grabs the files from. e.x: \\Server\Share\CiscoThousandEyes

>2.3 Configure the PowerShell Script Execution in SCCM

In the next wizard screen it will ask you for a name and the installation program like in below’s image.

• Name: The “Name” field can be left as default.
  
  
• Installation Program: in this field, it is critical to specify the following command
  with the corresponding specific values:
  
  
  • Powershell script file path (Include the .ps1 file name)
  • MSI Endpoint Agent file path (Include the MSI file name)
  • Endpoint agent connection string

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "<Your powershell script File.ps1>" -InstallerFilePath "<Your Endpoint Agent File.msi>" -AccountConfig "<EPA Connection String>" -EnableChromeExtension -EnableEdgeExtension

After configuring these fields, click “Next” on this and the following summary screen. After finishing the application creation wizard, you will see the application listed like in below’s image.

>2.4 Distribution Settings

Right click on the application and go to “properties” . We can see the multiple tabs, one of them is the “distribution settings” which is the process of moving the application’s source files (Powershell script and endpoint agent msi) from your site server to the Distribution Points (DPs).

• Content priority

This setting determines the order in which the Package Transfer Manager sends content to your Distribution Points. By default the content priority will be Medium, which is the the standard for most applications including ThousandEyes.

• Distribution Point

You can either automatically download the content when packages are assigned to the distribution points, or manually copy the content for this application to the distribution points. Whichever is best for your environment or deployment strategy.

>2.5 Poduct Code Clause (Software Detection)

The Detection method is important to verify the presence of the software in a particular machine using the correct MSI Product Code which it is the industry standard for reliability.
This clause is critical for your ThousandEyes deployment to Prevent Installation Loops.

SCCM checks the Windows Registry for that specific Product Code. If it finds it, it simply reports "Installed" and skips the execution.

Without a detection method, SCCM has no way of knowing the agent is already there. It will run your PowerShell script over and over again on every cycle, which wastes CPU and network bandwidth.

Since we are using a script and not the direct MSI file, you have to specify the product code by editting the clause and inserting the correct ThousandEyes Endpoint agent product code. This product code can be found in the ThousandEyesInstall.log file generated after the installation.

Log entry example:

MSI (s) (BC:BC) [14:55:12:667]: APPCOMPAT: looking for appcompat database entry with ProductCode '{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX}'.

You can also use the following powershell command to check the product code, example:

PS C:\Users\Alex > Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object {$_.DisplayName -like "*ThousandEyes*"} | Select-Object DisplayName, PSChildName

DisplayName                 PSChildName
-----------                 -----------
ThousandEyes Endpoint Agent {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX}

To add this product code, select Deployment Types under the ThousandEyes application Properties, Choose “edit”, and select “Detection Method”.

This is the section in which you can either modify or create a clause using the product ID taken from the previous step.

>2.6 Verify Content Locations

Under the content locations tab inside the ThousandEyes application properties, you will be able to see the Distribution points used for this application. In SCCM a distribution point is a server that acts as a local "warehouse" for your software files.

Its primary job is to store the content (like the ThousandEyes MSI and your PowerShell script) so that client computers can download them over the local network.

1. The client computer receives a Policy from SCCM saying "You must install ThousandEyes."
2. The client asks SCCM, "Where can I find the files?"
3. SCCM looks at the client's IP address and says, "You are in X location; go to DP-X-01” distribution point. The client then downloads and runs your script.

To add distribution points to the application you can select them by right clicking on the ThousandEyes application > Distribute Content, and then add the Distribution points you want, like in the following image.

3. Deploy the Application

The last step is to push the software.

1. Right click on the ThousandEyes application > “Deploy”, and select the collection of users or devices you want to deploy the software to by using the top-left dropdown.

2. Specify the settings to control this deployment.

Available: The application appears in the Software Center. The user decides if and when to install it.

Required: The application installs automatically without user intervention. (Recommended for ThousandEyes) 

Click next and the installation wizard will ask you for additional details like: Scheduling the deployment to a specific time, or if you want to display notifications about the application in software center.

After configuring this options, click “done” and the deployment configuration will be completed. The deployment takes about 1 hour to start with no manual intervention. However you can trigger the deployment manually in a machine by going to the Windows Control panel item “Configuration Manager Properties” > Machine Policy Retrieval & Evaluation Cycle > “Run Now”

Conclusion & Resources

We hope this article has been informative and helpful for you in deploying Endpoint Agents via SCCM utilizing a PowerShell script. 

If you have additional questions or need some extra help in the deployment, feel free to reach out to our Support team - they're available 24*7 to help you succeed! 

Additional reference material for information about endpoint agent installation:
Installing Endpoint Agents