1.1 Install Agent for Windows

RoboShadow Agent Deployment Guide for IT Managers

Introduction

This guide provides IT Managers with detailed steps and considerations for deploying the RoboShadow Agent on Windows machines. It is designed to ensure a smooth and successful rollout by addressing critical elements such as the OrganisationID, deployment strategies, and best practices for various scenarios.

Key Considerations

OrganisationID

Importance: The OrganisationID is crucial for the agent to report data correctly to the RoboShadow portal. Without it, no data will be displayed.
Planning: Plan the organisational structure before deployment. Changing organisations post-deployment is complex due to the DeviceId and public key being tied to the initial OrganisationID.

Uninstalling and reinstalling the agent

When the RoboShadow Agent is uninstalled, certain registry files are kept to assist with Agent upgrades and re-installing the Agent to a previously installed organisation.
Use case: Organisation A tests the RoboShadow Agent. After Testing, the Agent is uninstalled. At a later date Organisation A wants to go ahead with the rollout. The Agent is re-installed and needs to report into the same organisation.

Migrating the RoboShadow agent to another organisation

As the registry and public key are tied to an organisation, when migrating the RoboShadow Agent to a different organisation, a clean install is required and the device will need deleting from the previous organisation in the portal.

In the Windows “Apps and Features”, uninstall the RoboShadow Agent and the RoboShadow Update Service.
Delete the following folder “C:\ProgramData\RoboShadow”.
In the registry, delete the following entry “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\RoboShadowLtd”.
If the device is seen in the RoboShadow Portal, navigate to
https://portal.roboshadow.com/devices and remove the device using the “Trash can” icon.
a. If the device appears on the Cyber Heal page https://portal.roboshadow.com/cyber-heal, remove the device using the “Trash can” icon.
Re-install the RoboShadow Agent.

Deployment Methods

Intune Deployment

To Deploy the RoboShadow Agent via InTune, you first need to Sync with 365 which you can do from this page https://portal.roboshadow.com/devices. Once synced the deploy via InTune button will become enabled. You will then be able to deploy the RoboShadow Agent via InTune.

Click the “Deploy RoboShadow With InTune”
Follow the on-screen setup guide.

Super Ops Deployment

To deploy the agent via RMM with an ORGID variable use the following PowerShell script:

# Set a flag to indicate if OrgID is set
$haveSetOrgId = $True

 

# Attempt to retrieve the version from the registry
$version = (Get-ItemProperty -Path "HKLM:\SOFTWARE\RoboShadowLtd\Rubicon\Agent" -Name "Version" -ErrorAction SilentlyContinue).Version

 

# Check if OrgID is set and if the version is not found or less than 4
if ($haveSetOrgId -and (-not $version -or [int]($version -split '\.')[0] -lt 4)) {
    # Define the arguments for msiexec
    $arguments = @(
        "/i", "https://cdn.roboshadow.com/GetAgent/RoboShadowAgent-x64.msi",
        "/qb", "/norestart", "ORGANISATION_ID=$OrgID"
    )

 

    # Start the process to install the RoboShadow agent
    Start-Process -FilePath "C:\Windows\System32\msiexec.exe" -ArgumentList $arguments -Wait
}

When you run the script it will ask for the ORGID to be entered

MSI-Based Installation

Preparation:
- Ensure you have the correct OrganisationID.
- Plan your organisational structure in advance.
PowerShell Installation:
- Download the installation PowerShell script:
- https://raw.githubusercontent.com/roboshadow/RolloutScripts/master/DeployAgent/deploy.ps1
- Replace YOUR_ORGANISATION_ID with the organisationID from the correct organisation in the Portal. Note changing this after install is not trivial.
- Organisation ID can be found here: https://portal.roboshadow.com/account/organisations
- Set $haveSetOrgId to $True
- Save and run the PowerShell Script

Golden Image Deployment

Recommendation:
- Do not install the RoboShadow Agent on the golden image. Deploy the agent post-cloning to avoid issues with OrganisationID, DeviceId, and Public Key.
If Installing on Golden Image:
- Follow these steps to clean the image before running sysprep:
  - Ensure Updater is Installed: Verify that the updater component of RoboShadow is installed.
  - Delete OrganisationID Registry Key:
    - HKEY_LOCAL_MACHINE\Software\RoboShadowLtd\Rubicon\Agent\OrganisationId
    - HKEY_LOCAL_MACHINE\Software\RoboShadowLtd\Rubicon\Control\OrganisationId
  - Delete DeviceId Registry Key:
    - HKEY_LOCAL_MACHINE\Software\RoboShadowLtd\Control\DeviceId
  - Delete Public Key:
    - C:\ProgramData\RoboShadow\Rubicon\Control\Data\PublicKey

Group Policy Deployment

You can either deploy the Agent by creating a .MST or .BAT file, both methods are listed below

MST Deployment:

Open Orca, click file, open.

Select the RoboShadow agent

Copy your organisation ID from the portal

Click Transform, "New Transform"

Select the Registry table and update both OrganisationId values.

Click Transform > Generate Transform.

Save the MST file with name of the organisation you have updated

In Group Policy management, create a new policy and a new package

Select the MSI downloaded from our website

Choose the advanced option

Select Modifications, click Add

Select the MST file that you have created

Click Ok

Close

BAT Deployment:

Copy the script below into a text editor and modify the ORGID value.

@echo off
setlocal

:: Set organisation ID
set ORGID=

:: Check if RoboShadow is already installed
reg query "HKLM\SOFTWARE\RoboShadowLtd\Rubicon\Agent" /v Version >nul 2>&1
if %ERRORLEVEL% EQU 0 (
echo RoboShadow Agent is already installed.
goto : EOF

:: Install silently using msiexec
echo Installing RoboShadow Agent ...
msiexec /i https://cdn.roboshadow.com/GetAgent/RoboShadowAgent-x64.msi /qn /norestart ORGANISATION_ID=%ORGID%

:: Optional: log result to central share
\%COMPUTERNAME%.txt
echo %DATE% %TIME% - Installed by user >> "%LOGPATH%"

Save as install_roboshadow.bat
Place the .bat file on a shared network location( Ensure all target machines have read access to the location.)
Create a new GPO in GPMC and link it to the appropriate Organisational Unit (OU) containing target computers.
Create a Scheduled Task in the GPO

Navigate to: Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks

Create a new task with the below parameters:

If you run into any issues while deploying the Agent via Group Policy, please get in touch with our support team here: Hello@roboshadow.com

Big thank you to the team at qil.co.uk for helping us with the Group Policy Deployment documentation!

Summary

By following these guidelines, IT Managers can ensure a successful deployment of the RoboShadow Agent across their Windows environments. Proper planning and adherence to the recommended practices will mitigate common issues and enhance the effectiveness of the rollout.