Deploy endpoints to OneView with Microsoft Group Policy

Deploy the ThreatDown Endpoint Agent to many Windows endpoints at the same time by using a Group Policy Object (GPO) in Active Directory. When an endpoint restarts, the GPO is applied and the agent is installed. For other installation methods, including manual installation, see Add Windows endpoints in OneView.

The deployment has 3 steps:

1. Configure Windows Defender Firewall.
2. Download the Endpoint Agent MSI to a network share.
3. Create and link the deployment GPO.

Step 1: Configure Windows Defender Firewall

Endpoints must allow these inbound connections from the domain:

• TCP ports 135 and 445, and UDP port 137
• Remote administration (WMI and RPC)
• File and printer sharing

Open Domain Profile settings

1. Click the Start menu.
2. To open GPMC, type Group Policy Management and press Enter.
   • For Windows Server 2008 R2 and older operating systems, type gpmc.msc.
3. Under Group Policy Management, double-click Forest.
4. Double-click Domains to view the domain.
5. Under the domain, right-click Default Domain Policy and click Edit....
6. Go to Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile.

Add ports 135, 137, and 445

1. Double-click Windows Firewall: Define inbound port exceptions.
2. Select Enabled.
3. In the same window under Options:, click Show.
4. When the Show Contents window appears, under the Value column, enter 135, 137, and 445.
5. Click OK.
6. On the Windows Firewall: Define inbound port exceptions window, click Apply > OK.

Enable WMI and RPC

1. From the Group Policy Management Editor window, double-click Windows Firewall: Allow inbound remote administration exception.
2. On the Windows Firewall: Allow inbound remote administration exception window, click Enabled > Apply > OK.
3. Double-click Windows Firewall: Allow inbound file and printer sharing exception.
4. On the Windows Firewall: Allow inbound file and printer sharing exception window, click Enabled > Apply > OK. 

After completing all three steps, deploy the endpoint agent to the endpoints. 

Step 2: Download the Endpoint Agent MSI

1. Log in to OneView.
2. Click Download Center.
3. Select the site.
4. Click Start download for the Windows Endpoint Agent MSI.
5. Save the file to a network share that the Domain Computers group can read.
6. Note the file's full Universal Naming Convention (UNC) path, for example \\fileserver\software\ThreatDown\EndpointAgent.msi. It is needed for the next step.

Note: Use the UNC path, not a mapped drive letter or a local path. Endpoints can't resolve mapped drives or local paths during installation.

Step 3: Create and link the deployment GPO

1. On the Active Directory server, open Server Manager > Tools > Group Policy Management.
2. Right-click the Organizational Unit (OU) that contains the endpoints and click Create a GPO in this domain, and Link it here.
3. Name the GPO ThreatDown Endpoint Agent and click OK.
4. Right-click the new GPO and click Edit.
5. Go to Computer Configuration > Policies > Software Settings.
6. Right-click Software installation and click New > Package.

7. In the file browser, enter the UNC path to the MSI from Step 2 and click Open. Don't browse to it through a local or mapped drive.
8. In the Deploy Software window, select Assigned and click OK.

The package appears in the Software installation pane.

Endpoints install the agent on their next restart. To install sooner on an endpoint, run this command in command prompt as an administrator, then restart when prompted:

gpupdate /force

To confirm the Endpoint Agent was installed using a machine-wide GPO, check  the registry for Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt\{GUID}