Roll out the service agent to many Windows servers

Install the service agent on many Windows servers with a GPO, trying it on one server first.

What you need

Permission to create and link a GPO in your Active Directory domain.
A share that the servers’ computer accounts can read.
Administrator access to the appliance.

Roll out with a GPO

Open Servers › Add server › With service agent and create a separate rollout code under Install codes.
Open Servers › Add server › Several servers with GPO. Select the test server’s OU if AD access is configured, then click Download GPO package.
Put sslbrain-agent.msi on the share, for example \\file01\software\sslbrain.
Save the line from Startup script with the install code as sslbrain-agent.cmd. Change only the MSI path to the share. Keep the install code and addresses from the appliance:
```
sc query sslbrainagent >nul 2>&1 || msiexec /i \\file01\software\sslbrain\sslbrain-agent.msi /qn INSTALLCODE=<code> DESTINATIONS="https://<appliance>,cloud"
```
Create a GPO in Group Policy Management. Add the script under Computer Configuration › Policies › Windows Settings › Scripts › Startup and link the GPO to an OU with one test server.
Restart the test server and check the result below.
Only then link the GPO to the remaining servers. Close the install code when rollout is complete.

Copy the address list from the appliance. cloud is included only when connection via sslbrain Cloud (EU), E2E is allowed. /qn installs without windows; sc query skips servers where the service exists.

Check that it works

On the test server, Get-Service sslbrainagent shows Running. After a few minutes, the server appears under Servers › All servers and Last check-in updates on its server page. Status Connected · Not automated means the service agent is connected but an installation plan is missing.

Next step

Review the servers and create installation plans for their services.

If it fails

The service is missing → run gpresult /r /scope computer on the test server and check that the GPO was applied.
The MSI cannot be read → give the server computer accounts, such as Domain Computers, read access to the share.
The code is closed or expired → create a code under Install codes and copy the command into the startup script again.
The server is waiting for approval → check the server key.
The service runs but the server does not appear → follow The service agent does not check in.
Windows Installer is busy → let the other installation finish; the startup script retries at the next boot.
You use SCCM or Intune → use the MSI command below in your existing rollout.

Servers in a Windows domain

Use this page for servers in an OU that should get the service agent at startup. For one server, use Windows servers. AD access in the appliance provides an overview of expected, connected and missing servers; it is not needed for the GPO itself.

The rollout install code

Anyone who can read the startup script can read the code. Use a separate code and set Last day if needed. Close the code under Install codes when finished. Connected servers keep working.

The MSI on the share is used for installation. Once connected, the service agent can be updated from the appliance. The GPO creates no installation plans.

MSI command for SCCM and Intune

Use the MSI and command from the same page. Run in system context with 0 and 3010 as success codes:

msiexec /i sslbrain-agent.msi /qn INSTALLCODE=<code> DESTINATIONS="https://<appliance>,cloud"

Have the tool detect that sslbrainagent is already installed so it does not reinstall the MSI over a version the appliance has updated. The code may appear on the command line and in the MSI log; close it after rollout. GPO software installation cannot pass the install code; use the startup script.

MSI properties

Property	Meaning
`INSTALLCODE`, `CODE`	The install code. Use the property from the appliance command
`SERVER`	The appliance address for first contact. Without a code, the server waits for approval
`DESTINATIONS`	Comma-separated addresses in priority order; `cloud` means via sslbrain Cloud. Takes precedence over `SERVER`
`CLOUD`	`deny` blocks sslbrain Cloud locally; `allow` removes the block
`CODEFILE`	File containing the install code, readable only by Administrators and SYSTEM
`ALLOW_CUSTOM_AGENTS_FROM`	`LOCAL`, `APPLIANCE` or `APPLIANCE,LOCAL` allows your own integrations from the selected sources
`TRUSTEDKEYS_CUSTOM`	Key fingerprints for your own integrations. See approving your own integrations
`SCRIPTPOLICY`	Controls signed integrations. Default `15`; values from GPO take precedence. No change is needed for your own integrations when using `ALLOW_CUSTOM_AGENTS_FROM`
`LOGLEVEL`	Log level; default `info`
`CHECKININTERVAL`	Seconds between check-ins without an install code; default `900`
`STARTUPDELAYMIN`, `STARTUPDELAYMAX`	Delay before the first check-in without an install code; defaults `900` and `3600` seconds
`IGNORETLS`	`1` skips certificate checking without an install code. Unsafe
`NOPHONEHOME`	`1` disables all contact. For testing only

Use the Windows ARM64 edition under Other editions for ARM64 servers. See connection settings for the address list.

Registry settings

HKLM\SOFTWARE\sslbrain holds the string values ServerURL, Destinations, CloudDeny, IgnoreTLS, NoPhoneHome, ScriptPolicy, CheckInInterval, StartupDelayMin, StartupDelayMax, LogLevel, ToolsPath and AgentId.

Values under HKLM\SOFTWARE\Policies\sslbrain take precedence: ScriptPolicy, NoPhoneHome, IgnoreTLS, CloudDeny, CheckInInterval, ServerURL and TrustSignedBefore. The code and keys under HKLM\SOFTWARE\sslbrain\Credentials are DPAPI-encrypted and readable only by SYSTEM and Administrators. The code is deleted after enrolment. Restart the service after changes with Restart-Service sslbrainagent.