Press CTRL+K to open search

Installing agents using a golden or master image

  • Published on Sep 8, 2026
  • 4 minute(s) read
Prev Next

You can use a master or golden image to deploy the Endpoint Security Agent (HX) software to multiple physical or virtual host endpoints in your enterprise. When you install the Endpoint Security Agent (HX) software on an endpoint, the agent creates a private key, using information from the endpoint, to encrypt and decrypt all agent data. After installation, agent services will not start unless the private key is decrypted and matches the information on the endpoint where the agent was installed.

A unique agent ID must also be created for each endpoint on which the golden or master image is deployed. Otherwise, all of the endpoints deployed using that image will provision with the Endpoint Security (HX) server using the same agent ID, causing a cloned agent problem in your Endpoint Security (HX) environment.

Important

For the Endpoint Security (HX) server and Endpoint Security Agent (HX) software to communicate properly, each host endpoint must be assigned a unique agent ID. If the Endpoint Security (HX) server reports the presence of cloned agents in your Endpoint Security (HX) environment, read "Resolving Cloned Agents" in the Endpoint Security (HX) Server User Guide.

This section describes how to use a golden or master image to install the Windows or Linux agent software to multiple physical or virtual host endpoints and ensure a private key and a unique agent ID are created for each agent.

Note

Windows agent support for master or golden images is provided in TrellixEndpoint Security Agent (HX) version 20 or later versions.

Linux agent support for master or golden images is provided in TrellixEndpoint Security Agent (HX) version 25 or later.

Installing Windows agents using a golden or master image

Follow the steps in this section on the Windows system that you are preparing to use as a golden image that can deploy the Endpoint Security Agent (HX) software to multiple physical or virtual host endpoints.

These instructions are only required if you are using Sysprep, or something similar, for your golden image. If you are not using Sysprep, then you can just use INSTALLSERVICE=2 to install the agent.

To use a master or golden image to install the agent software on your Windows endpoint:

  1. Extract the msi file and agent_config.json file to a directory.

    Tip

    Save a copy of the agent configuration file (agent_config.json) in the main agent installation directory—%ProgramFiles%\FireEye\xagt—so that the agent reports to the server in the main agent installation directory by default.

  2. Install the agent with the INSTALLSERVICE=2 option.

    msiexec /i <msi installer> INSTALLSERVICE=2

    By selecting option 2, you are installing the agent in service mode and preventing the agent from automatically starting the agent service after installation. If you do not use option 2, all of the endpoints deployed using the golden or master image will report to the Endpoint Security (HX) server using the same agent ID.

  3. In the directory where you extracted the msi file and the agent_config.json file, create a file called setupSchTasks.cmd and add the following text to that file:

    Note

    Remove the line break at the end of the first line and the tenth line before you paste the script into your file. You can also copy and paste directly from the HTML version of this deployment guide.

    Important

    If you copy and paste the following paths please ensure that you amend each path to match where the files are located:

    • copy <full path to agent_config.json> c:\ProgramData\FireEye\

    • copy <full path to ProvisionxAgt.cmd> C:\ProgramData\FireEye\

    schtasks /create /ru SYSTEM /sc ONSTART /TN "config_xagt" /tr "cmd.exe /c sc config xagt start= demand"

    schtasks /run /TN "config_xagt"

    schtasks /delete /TN "config_xagt" /f

    echo "Delete the agent cryptographic keys"

    rd /s /q C:\ProgramData\FireEye\xagt\xacs

    del C:\ProgramData\FireEye\xagt\main.db

    copy <full path to agent_config.json> c:\ProgramData\FireEye\

    copy <full path to ProvisionxAgt.cmd> C:\ProgramData\FireEye\

    schtasks /create /ru SYSTEM /sc ONSTART /TN "prov_xagt" /tr "c:\ProgramData\FireEye\ProvisionxAgt.cmd"

  4. In the same directory, create a file called ProvisionxAgt.cmd, add the following text to the file, and save it with ASCII encoding:

    Note

    Remove the line break at the end of the third line and the sixth line before you paste the script into your file. You can also copy and paste directly from the HTML version of this deployment guide.

    @echo off

    IF ".%PROCESSOR_ARCHITECTURE%"==".AMD64" (

    "C:\Program Files (x86)\FireEye\xagt\xagt.exe" -i "C:\ProgramData\FireEye\agent_config.json"

    ) ELSE (

    "C:\Program Files\FireEye\xagt\xagt.exe" -i "C:\ProgramData\FireEye\agent_config.json"

    )

    schtasks /create /ru SYSTEM /sc ONSTART /TN "svccfg_xagt" /tr "cmd.exe /c sc config xagt start=auto"

    schtasks /run /TN "svccfg_xagt"

    sc start xagt

    schtasks /delete /TN "prov_xagt" /f

    schtasks /delete /TN "svccfg_xagt" /f

    del "C:\ProgramData\FireEye\agent_config.json"

    del "C:\ProgramData\FireEye\ProvisionxAgt.cmd"

  5. At the command prompt, change to the agent installation directory and run the setupSchTasks.cmd file as an administrator.

You can now use this system as a golden image. When the system boots for the first time, the scheduled task ProvisionxAgt.cmd runs. This task starts the provisioning process and will provision all systems deployed for the golden image.

If you reboot your golden image to update it, then you must uninstall the agent and use the above steps to reinstall it.

: