After you have downloaded or copied the installation package to your host endpoint, follow the instructions provided in this section to manually install the agent software on your Windows or macOS endpoints. See Downloading an Agent Installation Package from the Web UI.
Important
After installing or upgrading to Endpoint Security (HX) Agent version , you must restart your Windows endpoints to ensure agent notifications are started.
Note
If your endpoints uses a proxy server to connect to an Endpoint Security (HX) Server, see HTTPS proxy server overview and configuration before manually installing the agent software on your endpoints.
Important
For macOS 10.15 endpoints and above, Trellix and Bitdefender kernel extensions must be authorized to successfully complete installation. See your macOS System Preferences > Security & Privacy to do this.
Unzip the
*.zip(Windows environments) or.dmg(macOS environments) file. The Windows agent installation package consists of these files:The macOS agent installation package consists of these files:
Double-click the installation file to launch the setup wizard.
If you want to use installation options in Windows environments, do not double-click on the
.msifile. Run it as described in Windows Agent Installation and Uninstallation Options.Accept all suggested settings and the license agreement, and continue through the wizard.
When the wizard completes, click Finish (Windows environments) or Close (macOS environments).
Important
After installing or upgrading to Endpoint Security (HX) Agent version , you must restart your Windows endpoints to ensure agent notifications are started.
While a reboot is not required for the Windows Endpoint Security (HX) to work after it has been installed on a host endpoint, one may be required to complete the Windows installation and avoid problems with future installations that check for pending reboots. One way to determine whether a reboot is necessary is to run the following command at a Windows command prompt:
To query the event log, open the Windows command line and run the following command at the prompt:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1029] and * [EventData[Data='FireEye Endpoint Agent']]"
If a reboot is required, the following event will appear:
"FireEye Endpoint Agent. Restart required. The installation or update for the product required a restart for all changes to take effect. The restart was deferred for a later time."
You can use the following command to identify the name and process ID of the application that locked a Trellix system file open:
wevtutil qe Application /rd:true /f:text /q:"*[System/EventID=1025] and *[EventData[Data='FireEye Endpoint Agent']]"
This command returns the name and process ID of the application that locked a file open. In the example below, Firefox has the NamespaceToEvents.dll file open.
"FireEye Endpoint Agent. The file C:\Windows\FireEye\NamespaceToEvents.dll is being used by the following process: Name: firefox , Id 1060."
Close the application that caused the reboot. Run the wevtutil qe Application command above to verify if a reboot is still required.
An endpoint reboot may also be required in the rare instance when the agent executable cannot be replaced during the upgrade.
If you choose to install a Windows agent using the service mode installation option and you specify option 2, you will need to reboot the host endpoints after the installation is complete.
Verifying the Connection Between the Agent and the Endpoint Security
To verify that the agent has provisioned with the Endpoint Security (HX) Server, log in to the Web UI on the Endpoint Security (HX) Server and navigate to the Hosts page. The host machine on which the agent is installed is listed on this page.
In macOS environments, open Terminal and enter the following command to review the agent processes that are running:
ps aux | grep xagt
Depending on when you run this command, one agent process listed in the output may be running in Eventor mode if real-time indicator detection is turned on. The output will include the following text:
- -mode EVENTOR