Roll out the service agent to many Windows servers

The same install code and the same line that connect one server connect many. A GPO cannot fetch a file from an address, so the MSI file has to be on a share.

When you need this

Your Windows servers are in an Active Directory domain, and you do not want to log on to each one.
New servers in a particular OU should get the agent by themselves.
You already install software with SCCM or Intune.

For a single server, Windows servers is quicker.

The install code

Create a code for the rollout under Install codes on Servers › Install service agent, for example named “GPO”. A server that connects with the code is approved.

Anyone who can read the GPO’s startup script can read the code. In a domain that is usually every user. Use a code for the rollout alone.
Close the code under Install codes when the rollout is done, or give it a last day when you create it. Servers already connected keep running. New servers cannot connect with a closed code.
A machine that looks like a reinstall of a server already connected waits for an administrator on Install service agent (Approve new servers).
If the servers should connect through sslbrain Cloud, leave out DESTINATIONS (Servers outside your network).

Roll out with a GPO

Open Servers › Install service agent, choose Windows and the code, open Several servers, GPO or no internet, and click Download MSI.
Put sslbrain-agent.msi on a share the servers’ computer accounts can read, for example \\fil01\software\sslbrain.
Create a file sslbrain-agent.cmd with one line. Copy the line under Directly to the appliance from Install service agent, and change the file name to the full path on the share. The line already has /qn, so it runs without windows while nobody watches the screen:
```
sc query sslbrainagent >nul 2>&1 || msiexec /i \\fil01\software\sslbrain\sslbrain-agent.msi /qn INSTALLCODE=<code> DESTINATIONS="https://<appliance>,cloud"
```
sc query skips the installation on a server that already has the agent. The line on the page has cloud after the appliance while Allow agent communication through Cloud is on and the appliance is connected to sslbrain Cloud. Copy the list from the page rather than typing it: without cloud the agents do not use sslbrain Cloud.
Create a GPO in Group Policy Management and link it to an OU with one test server.
Open Computer Configuration › Policies › Windows Settings › Scripts › Startup and add sslbrain-agent.cmd.
Restart the test server and check it (Check that it works).
Link the GPO to the other servers.

A GPO software installation (Software Settings › Software installation) cannot pass the code. Use the startup script.

Once the servers are connected, the appliance updates the agent (Keep service agents up to date). The MSI file on the share is only used for new servers.

Silent installation with SCCM or Intune

Download sslbrain-agent.msi under Several servers, GPO or no internet on Install service agent.
Create an application in SCCM, Intune or a similar tool with the MSI file and the line under Directly to the appliance:
```
msiexec /i sslbrain-agent.msi /qn INSTALLCODE=<code> DESTINATIONS="https://<appliance>,cloud"
```
Let it run in the system context, with 0 and 3010 as success codes.

If the appliance updates the agents, let the tool install the agent, not upgrade it. The MSI file accepts a version older than the one installed, so a tool that installs again can downgrade an agent the appliance has updated.

The code is on the command line while the installation runs and can end up in a verbose MSI log. Close the code when the rollout is done.

Check that it works

On the test server, Get-Service sslbrainagent shows status Running. If the service is not there, check with gpresult /r /scope computer that the GPO has been applied.
After a few minutes the server is listed under Servers.
If it is listed under Servers waiting for approval on Install service agent, it looks like a reinstall. Approve it there.

If it fails

The service runs, but the server does not appear: The agent does not check in.
The installation stops with SSLBrain Agent needs its appliance or Angiv CODE eller SERVER. Specify CODE or SERVER: the line lacks the code. Copy it again from Install service agent. With /qn the message is not shown on screen; add /l*v C:\Windows\Temp\sslbrain-agent.log to the line and read it in the log.
The server cannot read the MSI file: give the computer accounts, for example the group Domain Computers, read access to the share.
The code is listed as Closed: new servers cannot connect with it. Create a new code and change the line in sslbrain-agent.cmd.
Windows Installer is busy: the script tries again at the next startup.

MSI properties

A new installation needs INSTALLCODE, CODEFILE or SERVER. An upgrade keeps the values that are not on the command line.

Property	Default	Meaning
`INSTALLCODE`		The install code from Install service agent, which the lines on the page use. Without `DESTINATIONS` the agent connects through sslbrain Cloud; only from version 1.4.0 does `SERVER` give a direct connection instead
`CODE`		From version 1.4.0 the same as `INSTALLCODE`, and with `SERVER` the agent connects directly and has sslbrain Cloud as fail-over. Version 1.3.3 does not know `CODE`; use `INSTALLCODE`
`SERVER`		The appliance’s address, for example `https://sslbrain.company.com`. Without an install code the server waits for an administrator to approve it. Used only for the first contact; after that the appliance manages the addresses (How the agent reaches the appliance)
`CLOUD`		`deny`: the agent never contacts sslbrain Cloud. `allow` lifts the block
`DESTINATIONS`		Addresses in order of priority, comma-separated, `cloud` for sslbrain Cloud. Takes precedence over what `CODE` and `SERVER` give. Without `cloud` the agent does not use sslbrain Cloud until an administrator clicks Turn Cloud on again for this agent on the server’s page
`CODEFILE`		A file holding the install code instead of `INSTALLCODE`. Only Administrators and SYSTEM may be able to read the file
`SCRIPTPOLICY`	`15`	Which signed scripts the agent runs (Your own scripts)
`LOGLEVEL`	`info`	Log level in the agent’s log file
`IGNORETLS`	`0`	`1`: the agent does not check the appliance’s certificate. Only without an install code, and unsafe
`CHECKININTERVAL`	`900`	Seconds between check-ins for an agent installed without an install code
`STARTUPDELAYMIN`, `STARTUPDELAYMAX`	`900`, `3600`	Seconds to wait before the first check-in for an agent installed without an install code
`NOPHONEHOME`	`0`	`1`: the agent contacts nothing, for testing only

Settings in the registry

The agent’s settings are in HKLM\SOFTWARE\sslbrain as string values: ServerURL, Destinations, CloudDeny, IgnoreTLS, NoPhoneHome, ScriptPolicy, CheckInInterval, StartupDelayMin, StartupDelayMax, LogLevel, ToolsPath and AgentId.

Values under HKLM\SOFTWARE\Policies\sslbrain take precedence, so settings that must be the same on every server can be set with a GPO: ScriptPolicy, NoPhoneHome, IgnoreTLS, CloudDeny, CheckInInterval, ServerURL and TrustSignedBefore.
The install code and the agent’s keys are in HKLM\SOFTWARE\sslbrain\Credentials, encrypted with DPAPI and readable only by SYSTEM and Administrators. The code is deleted once the agent is connected.
Restart the service after a change: Restart-Service sslbrainagent.

An agent installed with an install code gets its check-ins, retries and addresses from Agents › Connection (How the agent reaches the appliance).