Introduction

Within this guide we will cover how to obtain the Endpoint Agent installation packages, the 4 primary methods of installing the Endpoint Agent on a Windows device and how to verify your installation was successful.

Table of contents

• Obtaining an installation package
• Installing with Windows UI
• Installing using the Command Line

  • Step 1 - Login

  • Step 2 - Unzip

  • Step 3 - CMD

  • Step 4 - Command to run

• Remote Installations
• Group Policy Object (GPO) Installations
  • Create a GPO in Microsoft Domain Controller
  • Create the Installer MSIs
  • Performing the Group Policy Update
• Verifying an Installation
  • Check for running services
  • Looking through files and folders
  • Checking the registry

Obtaining an installation package

The installation of the Windows Endpoint Agent requires the appropriate installer package and can be obtained via the Field Effect MDR Portal's Downloads page.

Here you will be able to download the .zip bundles for both 32-bit and 64-bit versions of the Windows operating system.  Each .zip downloadable package contains 2 files:

1. “license.txt” - the license.txt file used to digitally sign the installation and is specific per organization.
2. “covalence-endpoint-<chipset>-<version>.msi” - the Windows installer file.

Partners must download and install the correct package for a specific organization making use of the Organization Selector.

The license.txt file within each package will define which organization the Endpoint will appear under within the MDR Portal.

Installing with Windows UI

The following section outlines the process of installing the endpoint agent onto a device using the Windows interface. See Obtaining the installation package section above for more on how to download installer packages. 

Log into the device as an Administrator and Unzip the contents of the installation package you downloaded earlier into to a new folder on the device.

Both files need to be unzipped into the same folder, or the installation will fail.

Navigate to your new folder with the two unzipped files and double-click the .msi installer file.

DO NOT edit the license.txt file as it will corrupt the installation.

The installation wizard will open. Follow the prompts to complete setup.

You’ll see a success message once the agent is installed.

You can now click Finish

If required we have a guide on troubleshooting common Windows installation issues.

Installing using the Command Line

To install via the command line you should follow the steps below to obtain an installation bundle and execute the CLI command replacing the various <PARAMETERS> with the equivalents you can obtain from the files withing the installation bundle.

Step 1 - Login

Log into the Endpoint device as an Administrator.

Step 2 - Unzip

Unzip the contents of the package into to a new folder on the device you are protecting.

Both files need to be unzipped to the same folder or the installation will fail.

Step 3 - CMD

Open a command prompt as an Administrator

Step 4 - Command to run

Enter the command below replacing the <PARAMETERS> where necessary:

• <VERSION>: This is part of the .msi filename that can be found within the installer bundle you unzipped.
• <YOUR_LICENSE_KEY>: This is the HASH value found within the “licence.txt” file also included in the bundle.

covalence-endpoint-<VERSION>.msi COVALENCE_LICENSE=<YOUR_LICENSE_KEY>

C:\Users\Administrator\Downloads\Unzipped package>covalence-endpoint-x64-3.0.5.msi COVALENCE_LICENSE=AAB34534AAAAAAAAAA==

Remote Installations

For Automated Windows installations, the msiexec command can be used to install an agent. 

Execute the command below replacing the <PARAMETERS> with those appropriate for your organization:

• <FULL_PATH_TO_MSI>: This depends on where the MSI is being stored within your organization's environment.  
• <YOUR_LICENSE_KEY>: This is the HASH value found within the “licence.txt” file also included in the bundle.

msiexec.exe /i <FULL_PATH_TO_MSI> COVALENCE_LICENSE=<YOUR_LICENSE_KEY> /qn

msiexec.exe /i  "Z:\Software\Field Effect\Agent\x64\v3.0.5\covalence-endpoint-x64-3.0.5.msi" COVALENCE_LICENSE=AAB34534AAAAAAAAAA== /qn 

These instructions are generalized to align with a common GPO deployment. You may need to adjust them to match your specific tools and environment. Knowledge of your Active Directory architecture is required, as well as the ability to create a GPO within your domain controller.

For this process, you will need to create a GPO for Field Effect MDR in your domain controller and then create GPOs for both 32 and 64 bit installation msi files.

Create a GPO in Microsoft Domain Controller

Open your domain controller and launch the "Group Policy Management" console (gpmc.msc).

Under Domains in the lefthand navigation, right-click the domain you want to apply a Group Policy Object to and select Create GPO. This will open a new window. Name the new GPO and click OK.

Right-click on the newly created GPO (our example is named Covalence) and select Edit. This will open the Goup Policy Management Editor.

Within the Group Policy Management Editor, expand Computer Configuration -> Preferences -> Windows Settings in the lefthand navigation. Right click on Registry within the Windows Settings folder and select New -> Registry Item. 

Use the following parameters for your new Registry Item: 

1. Action: Update 
2. Hive: HKEY_LOCAL_MACHINE 
3. Key Path: SOFTWARE\Field Effect\Covalence\Endpoint
4. Value name: License 
5. Value type: REG_SZ 
6. Value data: <YOUR_LICENSE_KEY>
   1. <YOUR_LICENSE_KEY>: This is the HASH value found within the “licence.txt” file included in the bundle you want to install

Click OK.

Create the Installer MSIs

This procedure must be done for both 32-bit and 64-bit installers. 

From the Field Effect MDR GPO you created above, expand Computer Configuration -> Policies -> Software Settings. From the Software settings folder, right click Software Installation and select New -> Package.

Browse to the .msi package, which must be located in an accessible network share location. You will then be asked to deploy the software and the select the deployment method. Select Advance and click Ok. 

Under the Deployment tab select the following:

• Assigned.
• Uninstall this application when it falls out of scope of management
• Install this application at logon

When creating the 32-bit msi, click Advanced and uncheck "Make this 32-bit X86 application available to Win64 machines".

Performing the Group Policy Update

Once you have created the GPO and .msi installer file, you will need to perform a group policy update. 

This can be done using the following command line in PowerShell:

GPUpdate.exe /force

Verifying an Installation

This section identifies the areas where elements of the endpoint agent exists for checking a successful installation. 

Check for running services

The easiest way to verify a Windows installation is to run a service control query to check that the two primary Endpoint Agent services are running. 

Open a command prompt as an Administrator and run both queries below and ensure both have a STATE of RUNNING

sc queryex CovAgent

sc queryex "Covalence Endpoint Service"

You can also check the file system to verify a successful installation. 

On the endpoint device, verify that the following folders and files exist:

• C:\Program Files\Field Effect\
• C:\ProgramData\Field Effect\
• C:\Windows\System32\drivers\CovAgent.sys

Checking the registry

You can also use the Registry Editor to verify that following have been added:

• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Field Effect
• Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (Covalence Sys Tray Launcher key)
• Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CovAgent