AQUILA EDR Deployment via GPO on Windows Server AD

• • Note the Network Path displayed in the Sharing tab (e.g., \\ServerName\SoftwareShare<ServerHostName>\ZIP).
  • This UNC path will be required when configuring the script for the Group Policy Object (GPO) for deployment.
    
    

    
    

    
    

5. Create the Logs Folder

The purpose of this Logs folder is to centralize all log processes from every endpoint where the EDR is deployed within the domain. This setup allows us to verify whether each endpoint has successfully installed the EDR and to easily identify and troubleshoot any errors that may occur during deployment.

• On a file server, create a folder (e.g., C:\Logs).

6. Set Permissions

• Grant the Full Control permission to both Domain Computers and Domain Admins.
• Do the same on the Security tab.
• Note the Network Path displayed in the Sharing tab (e.g., \\<ServerHostName>\Logs)

• Also don't forget to create one folder where you can save the script and should be shared advance and that has the same permission as the ZIP folder since when creating a GPO policy, it only accepts UNC Path.

NOTE:
If you already have a dedicated folder for storing the ZIP file and centralized logs, we can use that location. Just make sure to take note of its UNC path, as we’ll need it when updating the deployment script later.

Alternatively, we can update the script for you and send it back—so all you need to do is save the script and configure the Group Policy to deploy it. If you prefer this option, please email us at support@cytechint.com.

Editing the Script

To edit the provided script, you can use PowerShell ISE by following these steps:

• Click the Start menu and type PowerShell ISE.

• In the upper-right corner, click the Open Script icon (folder symbol).

• Navigate to the folder where the script was saved, then open the file.

• Variables need to change:
  • $elasticZipFile: put the UNC path where the ZIP file was saved. (e.g. \\WINJDHSGFYR\ZIP\edr-agent-8.18.1-windows-x86_64.zip).
  • $logServerPath: put the UNC path of the created Logs folder. (e.g. \\WINJDHSGFYR\Logs).

• Then Save Script.

Deploying AQUILA EDR via Group Policy

Use Group Policy Management to create and link a Group Policy Object (GPO) that deploys the AQUILA EDR agent to domain-joined computers.

1. Open Group Policy Management
   • In Server Manager, go to Tools → Group Policy Management.
     
     

     
     

     
     
2. Create a New GPO
   
   • In the Group Policy Management Console, expand your domain and right-click the Domain Controllers container (or the appropriate Organizational Unit (OU)).
   • Select Create a GPO in this domain, and Link it here.
     
     

     

     
     
     
   • Provide a descriptive name (e.g., DeployNew AQUILAPatch Elastic Agent MSIDeployment), then click OK.
     
     

     

     
     
3. Edit the GPO
   • Right-click the newly created GPO and select Edit.
     
     

     

     
     
   • In the Group Policy Management Editor, navigate to:
     Computer Configuration → PoliciesPreferences → SoftwareControl Panel Settings → SoftwareScheduled InstallationTasks
     
     
4. AddScheduled the MSI PackageTasks
   • Right-click then choose Software InstallationNew → NewScheduled →Task Package(At least Windows 7).
     
     
     
     
   • In the

     General fileTab

     dialog,
     browse
     • Action: toCreate
     the
     • Name: UNCyou pathcan set a name of the installerscheduled task. (e.g., \\ServerName\SoftwareShare\Deploy EDR Aquila Agent.msi)Agent)
     and
     • When selectrunning Openthe task, use the following user account: .
       
       NT

       

       AUTHORITY\SYSTEM
       
     • ChooseEnable AssignedRun whether user is logged on or not
     • Enable Run with highest privileges
     • Configure for: toWindows ensure7, theWindows agentServer installs automatically for all targeted computers.
       
       

       

       
       2008R2

• Triggers Tab
  • Click New
  • Begin the task: At startup
  • Delay task for: 1 minute
    
  • Enabled

• Actions Tab
  • Click New
  • Action: Start a program
  • Program/script: powershell.exe
  • Add arguments(optional): -NoProfile -ExecutionPolicy Bypass -File "\\<SERVERHOSTNAME>\Script\Install-EDRAgent.ps1" (e.g. \\WINSJHGJDHR\Script\Install-EDRAgent.ps1)

• Settings Tab
  • Enabled Allow task to be run on demand
  • If the task fails, restart every: 1 minute
    
  • Attempt to restart up to: 3 times

1. Finalize the GPO
   • Close the Group Policy Management Editor.
2. ApplyTest in the PolicyClient Computer before Deployment
   • Go to the test client computer that is connected to the domain.
   • Open CommandPowershell Prompt as Administrator.administrator
   • Run the command:
     gpupdate /force
     
   • Running it here refreshes the Group Policy on the server itself.
   • Open Task Scheduler and check if the scheduled task was reflected on the Task Scheduler Library.
   • If confirmed go back to Powershell
   • Run the command:
   • shutdown /r /t 0
   • To restart the test client computer
3. Verify Installation
   • Reboot the domain-joined computer, the AQUILA EDR agent should install automatically during startup.
   • Confirm the agent appears in the Programs and Features list or within the AQUILA EDR management console.

Troubleshooting Tips

If the AQUILA EDR agent does not install as expected after deploying the GPO, consider the following checks:

1. Verify UNC Path Accessibility
   • Ensure the network share (e.g., \\ServerName\SoftwareShare\Aquila Agent.msi) is accessible from target machines.
   • Confirm that Domain Computers have Read permissions on the shared folder.
2. Check GPO Application
   • Run gpresult /r on a target machine to confirm the deployment GPO is applied.
   • Verify that the GPO is linkedLogin to the correcttest Organizationalclient Unitcomputer (OU)and containingwait for the target1 computers.
   minute
   to run the task.
3. ConfirmYou MSIcan Installer Integrity
   • Testopen the AquilaTask Agent.msiScheduler fileagain byand manuallycheck installingTask itScheduler onLibrary a test machine.
   • Re-download the installer if the packagetask is corrupted.
   successful.
4. Ensure Policy Refresh
   • Run gpupdate /force onConfirm the clientagent, machine.
   • Restart the computer to trigger software installation.
5. Check Event Viewer Logs
   • Opencheck EventTask ViewerManager →and Windows Logs → Application.
   • Looksearch for Groupelastic-agent Policy or MSI installation errors (Event IDs 103, 104, 108).
6. Review Software Installation Settings
   • Confirm that the package was added underand Computer Configuration → Policies → Software Settings → Software Installationelastic-endpoint (not under User Configuration).
   • Ensure the package was configured as Assigned, not Published.
7. Firewall or Security Software Conflicts
   • Verify that local security software is not blocking MSI execution.
   • Ensure firewall rules allow communication to AQUILA EDR services.

If you need further assistance, kindly contact our support at support@cytechint.com for prompt assistance and guidance.