Skip to content

SCCM / Intune / GPO

Deploy the SentriKat Windows Agent fleet-wide with the tooling you already have. The pattern is identical everywhere: push the PowerShell script + run the one-line install command with an install token.

The one command (everywhere)

Create the token in SentriKat (Integrations → Agent Deploy → Mass / automated deploy → Create Install Token), then have your tool run:

powershell -ExecutionPolicy Bypass -File sentrikat-agent-windows.ps1 -Install `
  -ServerUrl "https://sentrikat.company.com" -EnrollToken "<YOUR_INSTALL_TOKEN>"

Each machine exchanges the token once for its own per-host key; the token is revocable at any time without touching enrolled machines. Re-running the command on an enrolled machine is safe.

  1. Package sentrikat-agent-windows.ps1 and a small install.ps1 containing the command above (Win32 app via the Content Prep Tool, or a Platform script for simple cases)
  2. Install command: powershell -ExecutionPolicy Bypass -File install.ps1
  3. Detection rule: scheduled task SentriKat Agent exists — e.g. script detection with if (Get-ScheduledTask "SentriKat Agent" -ErrorAction SilentlyContinue) { "installed" }
  4. Assign to your device groups. Run context: System.
  1. Create a Package/Application whose content is the script + the command line above as the install program
  2. Detection method: scheduled task SentriKat Agent present (script detection, same one-liner as Intune)
  3. Deploy to a device collection; run as system, hidden.
  1. Put the script on a readable share
  2. Computer Configuration → Policies → Windows Settings → Scripts → Startup → add a PowerShell script that runs the command above
  3. Guard against re-runs if you prefer: if (-not (Get-ScheduledTask "SentriKat Agent" -EA SilentlyContinue)) { ... } (re-running is safe either way)

Verify the rollout

  • Machines appear in Inventory → Endpoints as they enroll
  • On any machine: Get-ScheduledTask "SentriKat Agent" and Get-Content "$env:ProgramData\SentriKat\agent.log" -Tail 20
  • Revoke the install token when the rollout is complete

Notes

  • Default scan interval: 4 hours (-IntervalMinutes <n> to change)
  • Behind a proxy / internal PKI: add -ProxyUrl <url> / -CaCertPath <path>
  • There is no MSI — the script + scheduled task IS the agent (no resident service, minimal footprint)