Announcement

Collapse
No announcement yet.

One installer for all new clients?

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • One installer for all new clients?

    Is it possible to have one install agent software for all new devices? It's pretty tedious having to log into the portal and select "Enroll Device" and copy and paste that link or download that specific install and run it on every new device.

    What I'm looking for is something like:

    Download file: https://someURLonMYwebserver.com/MYc...OMODOagent.exe
    Then run it silently on command line: MYcustomCOMODOagent.exe /s


  • #2
    Originally posted by sunshinetp View Post
    Is it possible to have one install agent software for all new devices? It's pretty tedious having to log into the portal and select "Enroll Device" and copy and paste that link or download that specific install and run it on every new device.

    What I'm looking for is something like:

    Download file: https://someURLonMYwebserver.com/MYc...OMODOagent.exe
    Then run it silently on command line: MYcustomCOMODOagent.exe /s
    Hi, this is normal for most RMM as agents are setup for customers/groups or single one off systems.

    Select the bulk installer, have at least one "generic" default group enabled and once deployed it is fairly easy to move systems between that and your customer setup.

    I keep most of my customer installers on a personal keyring usb just for adhock onsite installs, but also have them on a simple web site for easy access for both myself and for new onboarding as required.

    Same as what you suggest www.mysite/agent.exe

    All others are deployed server/gpo setup.

    mcfproservices

    Comment


    • #3
      Originally posted by mcfproservices View Post

      Hi, this is normal for most RMM as agents are setup for customers/groups or single one off systems.

      Select the bulk installer, have at least one "generic" default group enabled and once deployed it is fairly easy to move systems between that and your customer setup.

      I keep most of my customer installers on a personal keyring usb just for adhock onsite installs, but also have them on a simple web site for easy access for both myself and for new onboarding as required.

      Same as what you suggest www.mysite/agent.exe

      All others are deployed server/gpo setup.

      mcfproservices
      Bulk Installer wants to download the ADDT tool which appears to allow you to remotely install the agent. I'd like to just grab an executable once for CompanyA and keep installing it for all CompanyA's new PCs. I don't mind creating an executable for each customer if that's possible?

      Comment


      • #4
        Sorry, I should have explained better.

        Choose the BULK installer you then create as per customer/company, in your case call it CompanyA

        You can then use that for every new system per CompanyA

        I have created the bulk installer for each company, so they are held in a folder/website/server and usb stick for usage anywhere if needed.

        But at each customer site is held only the installer for that company.

        I also have one generic default one I can use, then afterwards I can move the device to whatever customer group I need.
        Handy for ad hock onboarding for new users as can add a device first then create the customer a bit later.

        mcfproservices

        Comment


        • #5
          If you go to:

          Endpoint Manager >> Bulk Installation Package

          Then fill out User, Customer, and Device Group, Platform.

          Then click on Download button.

          A popup appears that says "Auto Discovery and Deployment Tool" with an option for Download.

          Do you just X (close) that dialog box and grap the .msi that was generated?

          Comment


          • #6
            Hello
            sunshinetp
            Member
            sunshinetp ,

            Auto Discovery and Deployment Tool discovers all endpoints on your network or Active Directory, and deploys the bulk installation package to found endpoints. You do not need to use this tool but it makes it easier to deploy all your endpoints at once. Please find details about enrollment methods below.

            https://help.comodo.com/topic-399-1-...f-Devices.html

            If you have any other question, I would be more than happy to answer.

            Best regards,
            Ilgaz

            Comment


            • #7
              So I downloaded the .MSI file produced by the bulk download page and made sure to select customer, user, etc.. Then did a silent install and it did install but on reboot I get a dialog box asking for token and port. Shouldn't the bulk installer have this info?

              The silent install was done like this:

              msiexec.exe /qn /norestart comodo-installer.msi

              Any other ideas?
              sunshinetp
              Member
              Last edited by sunshinetp; 12-29-2020, 08:03 PM.

              Comment


              • #8
                Originally posted by mcfproservices View Post

                Hi, this is normal for most RMM as agents are setup for customers/groups or single one off systems.

                Select the bulk installer, have at least one "generic" default group enabled and once deployed it is fairly easy to move systems between that and your customer setup.

                I keep most of my customer installers on a personal keyring usb just for adhock onsite installs, but also have them on a simple web site for easy access for both myself and for new onboarding as required.

                Same as what you suggest www.mysite/agent.exe

                All others are deployed server/gpo setup.

                mcfproservices
                When you install those customer installs from the personal keyring, does the agent popup a window asking for you to provide a token, host, and port?

                Comment


                • #9
                  Here's the answer in case anyone else is looking. You cannot have a permanent install per customer because the token expires every 90 days. So even if you set up GPO you will have to manually log into the Comodo/Itarian portal and redownload a new version of the bulk installer and update your GPO settings or else every new install after that 90 days will begin asking for token, host, and port. Same with storing these custom installs on a USB. What's the point to have it on a USB when it will expire in 90 days anyway.

                  For what it's worth, I'm not sure about other RMM's but Kaseya had a custom link / install per customer that never expired and made it super easy to deploy agents.

                  FYI.

                  Thanks to those who responded.

                  Comment


                  • #10
                    Hi
                    sunshinetp
                    Member
                    sunshinetp

                    Sorry for the late reply, I missed this post when it was first posted and I've just found it while looking for a script to download and install an MSI package.

                    Regarding this specific point:

                    Originally posted by sunshinetp View Post
                    You cannot have a permanent install per customer because the token expires every 90 days.
                    As far as I know, according to my own notes, at least since May 2019 the tokens generated for the ITSM package expire after 720 days. That's not permanent, indeed, but it's not a big deal to me to re-generate the tokens once every two years. Mind that this applies only to "Communication Client" packages only, if you are generating packages with the "Client Security" they might still expire after 90 days, due to the nature of the Security Client itself.

                    For reusing the downloaded ITSM agent installation package, this is very important to know: the file name is linked to the enrollment token, so the weird file name should not be changed under any circumstance or it will not be able to auto-enrol and it will ask for the token, host, and port. If you have renamed the MSI package, that's why it was asking for the token...

                    Going a bit deeper into this topic, the "custom" MSI package is not custom at all: if you verify the checksum of different packages, you will find that the checksum is the same, only the filename is different. So, you could just keep note of the file names generated for your enrolment tokens, and then just download the generic package and rename it with the "tokenized" filename; it will install and auto-enrol the endpoint on the adequate Device Group.

                    In fact, this is what our deployment CMD script does: we have a single MSI package for all the entities, the deployment script just reads an environment variable that tells it which entity is being deployed, it then copies the MSI package to a temporary folder, rename the MSI package with the "tokenized" filename, runs the installation and at the end deletes the package from the temporary folder. With that simple trick, we are deploying a dozen different entities with a single MSI package.

                    Let me know if you still need help on this topic, I have a couple of tricks more that I can share if you need it.

                    Best regards,

                    -- Javier Llorente
                    Endpoint Security, Devoteam

                    Comment


                    • #11
                      If I want to install this via Microsoft Endpoint Manager (Intune), how would I make this work? I have tried to install it as a LOB App (without changing the name of the installer) but that still required the Host and Token info to enroll.

                      Comment


                      • #12
                        Hi
                        RichAY
                        Junior Member
                        RichAY,

                        I'm not sure, I have not used LOB Apps yet, but if it's asking you for the Host and Token info to enrol, clearly there is something that it's not working.

                        The first step would be to check the MSI package log, look for a line that begins with "Property(S): CDM_TOKEN" and confirm that it's equal to the token in the msi package filename. The tokenized filename will be something like "em_RC_CDMTOKEN_installer.msi", where RC is the Region Code (either "us" or "eu") and the CDMTOKEN is an eight-character alphanumeric string. If the MSI log is showing the CDM_TOKEN as blank, this means that the tokenized filename is being lost somewhere.

                        I'm not sure if this token value could be passed as a Public Property to the msiexec command. In such a case, the format would be the following:

                        Code:
                        msiexec /i "itsm_agent.msi" /qn /L*v "C:\SetupLogs\Itarian_EMCC.log" CDM_TOKEN=Wh4t3V3r
                        I've never tested this method and this doesn't seem to be documented anywhere, but it might be worth trying it. let me know if this works for you.


                        Best regards,

                        -- Javier Llorente
                        Endpoint Security, Devoteam

                        Comment


                        • #13
                          I have attempted (with no joy) to modify what you have provided as i think this doesn't exactly work the way you think it might. it failed to install (at all) with the provided arguments. please let me know what else to try.
                          You do not have permission to view this gallery.
                          This gallery has 2 photos.
                          RichAY
                          Junior Member
                          Last edited by RichAY; 06-09-2021, 05:21 PM.

                          Comment


                          • #14
                            Hi
                            RichAY
                            Junior Member
                            RichAY

                            Hmmm... In the CDM_TOKEN parameter, you must not use the long token provided in the User page on the EM; there you must use the short token that is included in the MSI package filename (in this case, iwXXXX0w, mind the upper and lower cases). Also, check the "C:\SetupLogs\Itarian_EMCC.log" file, look for CDM_TOKEN and check if it's being filled properly.

                            Good luck and best regards,

                            -- Javier Llorente
                            Endpoint Security, Devoteam

                            Comment


                            • #15
                              I think i'm understanding it correctly now. i've updated the arguments to "/L*v "C:\Itarian_EMCC.log"" and noticed that the log shows that the installer file name is different than if i were to install it directly to a computer (Microsoft in their wisdom apparently changes it when sending it to the client to be installed.) i've updated the arguments to just add the CDM_TOKEN=iw******* (the line I got from the log and the file name) and will update my findings after it pushes down the installer again.

                              Comment

                              Working...
                              X