Installing Endpoint Agent (Windows)

Note:

Please read the prerequisites and system requirements page before proceeding

Install

1. Please navigate to the portal and select your tenant from the dropdown menu. This will also display your Activation Code.

2. Choose Windows, then click on the "GENERATE DOWNLOAD LINK" button, then "CLICK HERE TO DOWNLOAD".

   

3. Once it is downloaded, double-click and open the installer. It will prompt you to enter the activation code. Copy the activation code from the portal and paste it into the field. Then click "Next".

   

4. You will be displayed with a Sysinternals EULA and checkboxes to accept the license. Make your choice by clicking one of the checkboxes then click "Next".

   

Note:

Sysinternals are a suite of products developed by Microsoft. ThreatDefence recommends accepting the EULA to install Sysinternals.

tip

Further documentation on the products are available here:

• Sysmon | Microsoft Learn
• Autoruns | Microsoft Learn

5. Once you've accepted the EULA, you'll encounter an advanced option allowing you to override the Sysinternals download source. Leave as blank and click "Next".

tip

For more information on how to use the override see Advanced Windows Install

6. Click the "Install" button to begin the installation.

7. You should see the window below, click “Finish” and the installation will be completed.

Advanced Install - Command Line / Silent

Silent installation can be achieved via the following command line argument:

Msiexec.exe /i TD_Endpoint.msi /qn ACTIVATION_CODE=xxx SYSINTERNALS_ACCEPT_EULA=Yes

Command Line Install Options

Argument	Required	Description	Examples	Default
ACTIVATION_CODE	Y	Unique activation code, distributed on portal		N/A
SYSINTERNALS_ACCEPT_EULA	N	Accepts the Sysinternals software license terms available here.	SYSINTERNALS_ACCEPT_EULA=Yes	No
REDIST	N	URL or Local directory path to pre-downloaded Sysinternals binaries. For use in restricted networks. See our article, Redist Override, for more info.	REDIST=http://web01.mycompany.com/td REDIST=C:\windows\temp\td	N/A
AUTO_UPDATE	N	Disable the automatic updater.	AUTO_UPDATE=No	N/A

Advanced Install - Group Policy

For enterprise deployments, see our article on MSI Transform files

Uninstall

1. Go to “Apps & Features" or "Add/Remove Programs”.
2. Type “TD_Endpoint”, choose TD_Endpoint and click “Uninstall”.

Advanced Uninstall - Command Line / Silent

1. Open PowerShell by pressing Windows Key + X and select Windows PowerShell (Admin).

2. Retrieve the application's IdentifyingNumber by entering Get-WmiObject Win32_Product

3. Uninstall the application using the following command, replacing IdentifyingNumber with that retrieved in the previous step:

msiexec.exe /x "<IdentifyingNumber>" /qn

tip

Ensure you enclose the IdentifyingNumber with double quotes. e.g.

msiexec.exe /x "{3357A676-12AA-42AB-ADF3-A3DC3E0EA726}" /qn

TD_Endpoint agent will now be uninstalled from your system.

Post-Install Configuration Options

tdcli.exe is located in C:\Program Files\TDagent\tdcli\tdcli.exe and accepts several command-line options to modify existing installs.

Argument	Description	Example
upgrade-sysinternals	Upgrades sysmon to the latest available at https://live.sysinternals.com/. Note: Will be overridden by REDIST path if set during install.	C:\Program Files\TDagent\tdcli.exe upgrade-sysinternals
disable-sysinternals	Uninstalls and disables Sysinternals binaries.	C:\Program Files\TDagent\tdcli.exe disable-sysinternals
enable-sysinternals	Installs and enables Sysinternals binaries.	C:\Program Files\TDagent\tdcli.exe enable-sysinternals