Sysprep lets IT teams build a golden image with the operating system, required software, and configurations installed and tested. This enables quick onboarding of new employees and machine rebuilds, ensuring every endpoint starts in an identical, good state and dramatically reducing deployment and configuration time. This article explains how to deploy the ThreatDown Endpoint Agent using Sysprep.
CAUTION - The base image environment must not have internet access during agent installation. If the agent connects to the internet while installing on a base image, it automatically registers in the console and receives a unique machine ID. This prevents proper endpoint visibility in the console, as all cloned machines appear as a single endpoint, making it impossible to manage, monitor, or apply policies to your fleet individually. Do not skip this step.
There are two parts to the process: create the installer, and install the Endpoint Agent on your base image.
Create the installer
Before you create the image, you need to download the MSI installer package. For MSI installer requirements, see the System requirements for Nebula
- To create the installer, follow steps 1–4 in this article: Add Windows endpoints in Nebula.
- After downloading and exporting the package in step 5, return to this article and follow the install steps below.
Install the endpoint agent on your base image
- Copy the installer to your base image environment.
- Disconnect your base image environment from the network before proceeding. Confirm there is no internet access before running the installer.
- Run the endpoint agent installer.
- If you need to add proxy information, you may do so during installation. See Change proxy settings for Endpoint Agent.
- If you prefer to script environment setup tasks, proxy information can be set with switches when using the MSI-based installer.
- If you require a network connection to complete other tasks before Sysprep, you must stop the agent service before reconnecting to prevent automatic ID assignment:
- Open services.msc.
- Right-click ThreatDown Endpoint Agent and select Stop.
- Allow 1–3 minutes for the service to fully stop. Only after the service status shows Stopped is it safe to re-enable network connectivity.
- When installation is complete, perform Sysprep generalization and image capture.
- Before wide deployment, test the new base image on 2–3 machines to confirm the agent clones correctly without ID conflicts.
Post-deployment notes
Once the image is deployed and the endpoint user logs into Windows, the Endpoint Agent:
- Performs a check-in.
- Receives an ID assignment.
- Downloads and installs real-time protection and scanning engine items, configured according to Nebula's Group and Policy settings.