Press CTRL+K to open search

Windows xAgent installation options

  • Published on Sep 8, 2026
  • 5 minute(s) read
Prev Next
Skip to main content

Many options are available when you install Endpoint Security (HX) xAgent software on your Windows hosts.

Note

If you are deploying the Endpoint Security (HX) xAgent software in a VDI environment, Trellix recommends deploying in a persistent or semi persistent VDI environment. See the Endpoint Security Agent (HX) Deployment Guide.

Some options are provided by the Windows msiexec executable; others are provided by Trellix extensions of msiexec. Specify these options when you initiate the installation. A standard installation setup wizard will perform the installation, using the options you specify.

Standard msiexec options you might find useful are listed in the following table. For complete information about all standard msiexec options, see your Microsoft documentation or enter msiexec /h at a command prompt.

Install Option

Description

/i

Install or configure the software. Specify the name of the installation *.msi executable file.

/qn /qb /qr /qf

Set the user interface level for the install process:

  • /qn: no user interface

  • /qb: basic user interface

  • /qr: reduced user interface

  • /qf: full user interface

/quiet

Install the product in quiet mode.

/l*v

Enable agent logging for the install process.

/norestart

Do not restart the system after the installation is complete.

This section explains how to use the Trellix extensions to the msiexec executable to install Trellix Endpoint Security (HX) xAgents software on your Windows hosts.

Specifying the xAgent installation location

To change the installation location of the xAgent software, use the TARGETDIR option. Always use quotes around the path name specified with this option.

For example, the following command installs the xAgent software in C:\MyInstallationDirectory:

msiexec /i xagtSetup_x.x.x_universal.msi TARGETDIR="C:\MyInstallationDirectory"

The default directory name for installations is %ProgramFiles%\FireEye\xagt.

If you are migrating your older agents (agents earlier than version 20) to a newer version of the xAgent software and you installed your older agents in a customized installation location, see Upgrading Older Agents with Customized Installation Locations .

Setting up a disguised installation

You can use the disguise installation mode to hide the agent from the Windows Control Panel programs list and conceal the service name and description. To disguise the installation of the agent, you will need to run the installation with the DISGUISE=1 option, change the agent display name, and the agent service description. When you disguise the agent, the following changes occur:

  • The Add/Remove program registry keys are not installed, so the disguised agent software does not appear in Windows Programs and Features. This means that it cannot be uninstalled from there. To uninstall a disguised agent, run the installation .msi file from the command line, but be sure you use the .msi file for the same agent version that is installed on the host endpoint.

  • The agent service description is empty. In an undisguised installation, it is Trellix xAgent.

  • The agent display name changes from Trellix Trellix Endpoint Security (HX) xAgent to the value you input.

  • The agent service description changes from Trellix Endpoint Security (HX) xAgent to the value you input.

The following example disguises the agent installation, changes the Display Name to My Service, and changes the Service Description to My Service Description:

msiexec.exe /i xagtSetup_x.x.x_universal.msi DISGUISE=1 DISPLAYNAME="My Service" SVCDESCRIPTION="My Service Description"

Specifying an Alternate Configuration File Location

You can install the agent when the agent_conf.json file is not in the same directory as the .msi file downloaded from the Endpoint Security (HX) server. Use the CONFJSONDIR option when you run the installation.

The following example runs the installation software using the agent_conf.json file in directory c:\temp:

msiexec.exe /i xagtSetup_x.x.x_universal.msi CONFJSONDIR=c:\temp

Installing the xAgent in Service Mode

Note

Support for this functionality is provided in Trellix Endpoint Security (HX) xAgent version 20.40.1 and later.

Use the INSTALLSERVICE option to install the agent software in service mode.

Valid values for the INSTALLSERVICE option are the numbers 1 or 2:

  • Specify 1 to install the xAgent in service mode and start the service. This is the default. Service mode allows you to run the agent as a service.

  • Specify 2 to install the xAgent in service mode without starting the service. Use this option if you intend to use a master or golden image that will be deployed to multiple physical or virtual endpoints. If you do not use this option, all of the endpoints deployed using the golden or master image will report to the Endpoint Security (HX) server using the same agent ID. Use option 2 to delay the attempt to obtain an agent ID until the next reboot of the endpoint on which the image is installed. See  .

    Important

    When INSTALLSERVICE is set to 2 in macOS environments, host endpoint containment notifications do not work until the endpoint user logs off and logs in again.

The following example installs the agent as a service without starting the service:

msiexec /i xagtSetup_x.x.x_universal.msi /norestart INSTALLSERVICE=2

Important

If you are deploying the Endpoint Security (HX) xAgent software in a VDI environment, Trellix recommends deploying in a persistent or semi persistent VDI environment. See  .

: