========================================================================

WINDOWS AGENT INSTALLATION GUIDE

Posted: 2026-07-08
Updated: 2026-07-08
By: sofnet

PRODUCT OVERVIEW

This document provides step-by-step instructions for deploying the UPAS
Agent across an enterprise domain environment. It covers deployment via
Active Directory Group Policy Objects (GPO) as well as manual on-site
installation methods.

FILE REFERENCE CHECKLIST
[ ] GPO Deployment Script: Deploy-UPASAgent-GPO.bat
[ ] Manual Install Script: Manual-Install-UPASAgent.bat
[ ] Executable Package: Security pattern *.exe
(e.g., Security pattern 8.26.2606.0811.exe)

========================================================================

PART 1: GPO AUTOMATED DEPLOYMENT (VIA STARTUP SCRIPT)

[Description]
Utilizes Active Directory Group Policy to automatically deploy the UPAS
Agent using the ‘NT AUTHORITY\SYSTEM’ account during machine startup.

[Prerequisites]

• Place both the GPO batch script (.bat) and the installer executable (.exe)
  in the SAME directory within the GPO SysVol path.
• Maintain the default NTFS permissions for the SysVol path
  (“Authenticated Users” with Read & Execute). No custom permission
  modifications are required.

[Step-by-Step Configuration]

1. Log in to the Domain Controller (DC) and open “Group Policy Management”.
2. Create a new GPO (or edit an existing one) linked to the target
   Organizational Unit (OU) containing the domain computers.
3. Navigate to:
   Computer Configuration -> Policies -> Windows Settings -> Scripts (Startup/Shutdown)
4. Double-click “Startup” and click “Show Files…”.
5. Copy both “Deploy-UPASAgent-GPO.bat” and the “Security pattern *.exe”
   package into this opened directory.
6. Close the folder window, return to the “Startup Properties” window,
   and click “Add”.
7. Browse and select “Deploy-UPASAgent-GPO.bat”, then click “OK”.
8. Apply the GPO.

[Verification & Troubleshooting]

• Optimized Pre-Check: Clients that already have the Agent installed
  will automatically bypass the script execution in less than 0.1 seconds.
• Initialization Delay: For uninstalled clients, a 15-second network
  initialization delay is enforced before launching the installer via the
  direct UNC execution path.
• Audit Logs: Deployment logs are generated locally at
  “C:\upas_gpo_log.txt” for auditing purposes.

========================================================================

PART 2: MANUAL INSTALLATION & CONNECTION VERIFICATION

[Description]
Used by IT technicians for on-site manual installations, staging, or
troubleshooting specific target workstations.

[Prerequisites]

• The technician must execute the script with Local Administrator privileges.
• Keep “Manual-Install-UPASAgent.bat” and the “Security pattern *.exe”
  installer in the same directory (supports network shares or local folders).

[Step-by-Step Execution]

1. Right-click “Manual-Install-UPASAgent.bat” and select “Run as administrator”.
2. The command prompt will execute the installation silently in the background.
3. The script features a two-phase validation mechanism:
   • Phase 1: Verifies the creation of “UPASAgent.exe” under Program Files.
   • Phase 2: Uses PowerShell to parse the current date, locate today’s
     ADLOG (ADLOG-YYYY-MM-DD.txt), and inspect for the “Success” network
     registration keyword.

[Interactive GUI Feedback Window]
Upon completion, an explicit English graphical dialog box will pop up with
one of the following statuses:

• “UPAS Agent installation completed…”
  -> Success. Both file creation and Sensor connectivity are active.
• “Installation FAILED…”
  -> Critical error. Executable creation failed due to permission or
  package integration issues.
• “Installation Warning… ‘Success’ keyword not found…”
  -> Warning. The installation file was created successfully, but
  connectivity to the designated Sensor IP failed. Please check
  network routing and firewall rules.
• “UPAS Agent is already installed…”
  -> Aborted. Pre-check indicates the machine is already managed.

========================================================================

SUPPORT & MAINTENANCE NOTES

• Wildcard Compatibility: Both scripts natively support wildcard (*) matching.
  For future Agent updates, administrators only need to replace the older
  .exe with the new executable package in the designated folder. No script
  modifications are required.