Deploying SentinelOne in a Active Directory environment

Manual installation

When launching the msi, the SentinelOne installer asks for a Token.

We can't use the native msi GPO software installation for this one. (I even tried, without success, a solution with Orca to add token property.).

• Anyway, we can add token property with the msiexec command, this way :
• /i : install
• /q : Quiet mode, no user interaction
• /norestart : do not restart after the installation is complete

C:\>msiexec /i "SentinelInstaller_windows.msi" /q /norestart SITE_TOKEN="ps3GpmsPqogCBKF0ANnRhmUVptppZlKPMncnl2CGNG6cbaHia3yRHw6aWRb12AeDSj5NpabG1T4A6XPWzOsHt62jAgwK8IL5l0JibeWa"

This will help us to write the installation script.

Batch Script

• I wrote a small installation script to install SentinelOne only if it has not already been installed :

@echo off

:REM check if "HKLM\Software\Sentinel Labs" registry key is present
reg query "HKLM\Software\Sentinel Labs"

:REM if "HKLM\Software\Sentinel Labs" registry key is present, it means that sentinel has already been installed on this host, so go to the INSTALLED switch of the script
IF %ERRORLEVEL% == 0 goto INSTALLED

:REM Copy SentinelInstaller_windows.msi installer from SYSVOL share to local TEMP folder WORKSTATION
copy \\std\sysvol\std.local\scripts\SentinelOne\SentinelInstaller_windows.msi c:\windows\temp\ /Z /Y

:REM install msi package
msiexec /i "c:\windows\temp\SentinelInstaller_windows.msi" /q /norestart SITE_TOKEN="ps3GpmsPqogCBKF0ANnRhmUVptppZlKPMncnl2CGNG6cbaHia3yRHw6aWRb12AeDSj5NpabG1T4A6XPWzOsHt62jAgwK8IL5l0JibeWa"

:REM if install is ok go to OK switch
IF %ERRORLEVEL% == 0 goto OK

:REM if install fails go to ERROR switch
goto ERROR

:INSTALLED
echo "Already Installed"
goto END

:ERROR
echo "Install Error"
goto END

:OK
echo "Install OK"

:END

• From Active Directory save batch script and SentinelOne msi package to C:\Windows\SYSVOL\sysvol\std.local\scripts\SentinelOne :

Create Group Policy Object

We will therefore create a GPO that will execute the installation script when our computers start up.

• Open Active Directory Users and Computers console :

• Move Computers where you want to install SentinelOne to Workstations OU (Organizational Unit) :

• Open Group Policy Manager console :

• Create GPO :

• Give a name to the new GPO :

• Edit the GPO :

• Go to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown). Do a Right click Startup > Properties

• Click Add… and Browse to the script :

And that's it…