How to Deploy SentinelOne in an Active Directory Environment

Last updated: Oct 19, 2024

I was recently asked to deploy the brand-new SentinelOne ~~antivirus of the death from hell that kills~~ XDR (for Extended Detection and Response) in a Windows Workstation environment…

If you haven't seen the movie, it's a security tool that uses an AI engine to prevent, detect and respond to software threats.

As you can see, it's "blah blah blah" amazing, but how to deploy it? Well, I couldn't find a predefined method for deploying it on a large scale.

So I had to find a way to do it… Let's see how I did it!

Manual installation

When the msi is launched, the SentinelOne installation program requests a token.

Because of this, you can't use the traditional msi software deployment via GPO for this installation. (I even tried, unsuccessfully, a solution with Orca (see here: https://docs.microsoft.com/) to add the token property.).

We can add the token property with the msiexec command, as follows:
- /i: install
- /q: Quiet mode, no user interaction
- /norestart: do not restart after the installation is complete

C:\>msiexec /i "SentinelInstaller_windows.msi" /q /norestart SITE_TOKEN="ps3GpmsPqogCBKF0ANnRhmUVptppZlKPMncnl2CGNG6cbaHia3yRHw6aWRb12AeDSj5NpabG1T4A6XPWzOsHt62jAgwK8IL5l0JibeWa"

This is the command we'll use in our installation script.

Batch Script

I've written a small installation script to install SentinelOne only if it hasn't already been installed:

@echo off

REM check if "HKLM\Software\Sentinel Labs" registry key is present
reg query "HKLM\Software\Sentinel Labs"

REM if "HKLM\Software\Sentinel Labs" registry key is present, it means that sentinel has already been installed on this host, so go to the INSTALLED switch of the script
IF %ERRORLEVEL% == 0 goto INSTALLED

REM Copy SentinelInstaller_windows.msi installer from SYSVOL share to local TEMP folder WORKSTATION
copy \\std\sysvol\std.local\scripts\SentinelOne\SentinelInstaller_windows.msi c:\windows\temp\ /Z /Y

REM install msi package
msiexec /i "c:\windows\temp\SentinelInstaller_windows.msi" /q /norestart SITE_TOKEN="ps3GpmsPqogCBKF0ANnRhmUVptppZlKPMncnl2CGNG6cbaHia3yRHw6aWRb12AeDSj5NpabG1T4A6XPWzOsHt62jAgwK8IL5l0JibeWa"

REM if install is ok go to OK switch
IF %ERRORLEVEL% == 0 goto OK

REM if install fails go to ERROR switch
goto ERROR

:INSTALLED
echo "Already Installed"
goto END

:ERROR
echo "Install Error"
goto END

:OK
echo "Install OK"

:END

What the script does:
- Check wether the entry "HKLM\Software\Sentinel Labs" exists in the registry (if it does, this means SentinelOne is already installed, so exit the script.).
- If not, copy the SentinelInstaller_windows.msi file from AD share to c:\windows\temp\.
- Then install the msi package.

From an Active Directory server, save the batch script and the SentinelOne msi package in C:\Windows\SYSVOL\sysvol\std.local\scripts\SentinelOne: