Proofpoint | ObserveIT On-Premises Insider Threat Management

Installation Script Switches and Parameters

Following are the most commonly used switches and parameters for running an installation script for the Windows Agent.

MSIEXEC core switches

• /quiet (optional): Quiet mode.

• /norestart (optional): Does not require restart after install.

• /leo (optional): Logging, error messages, and out of disk space messages.

ObserveIT parameters

• SERVERURL (mandatory): Directs communication to the specified Application Server. You can also specify the port number. For example: SERVERURL=”http://srv1:4884/ObserveITApplicationServer”.
  You can use a hostname, an FQDN, or an IP address.

  When using https you must use the Application Server’s Fully Qualified Domain Name (FQDN) for the SERVERURL switch, and the port number can be omitted (unless a port other than the default 443 is used). For example: SERVERURL="https://srv1.domain.com/ObserveITApplicationServer.

  Use the offline~ parameter at the beginning of the URL in order to direct the Agent not to register itself on the ObserveIT Application Server during the installation. This parameter should be used with the NoRunOnInstall="1" parameter, described below.

• NoRunOnInstall (optional): Directs the Agent not to run after the installation was completed. Note that this parameter will NOT prevent the Agent from running upon the next time a user logs on to that system. This parameter should be used with the offline~ parameter described above. For example: NoRunOnInstall="1".

• SRVPOLTMPL (optional): Server Policies Template to inherit policy-based configuration from upon installation. The default is "00000000-0000-0000-0000-000000000000", and it will point the Agent to the Default Configuration Policy. For example: SRVPOLTMPL="00000000-0000-0000-0000-000000000000". For more information, see Creating Recording Policies.

• NeverRegister="1" : Prevents the Agent from ever being registered with the master image machine name on the ObserveIT system. Any other clone machine from that image can be registered with its own name, as long as the name is different to the original image name.

• SELECTED_REGISTER_MODE: (optional) Specifies how the register the Agent with the Application server.

  • SELECTED_REGISTER_MODE="1": Normal registration
  • SELECTED_REGISTER_MODE="2": Unregistered
  • SELECTED_REGISTER_MODE="3": Master Image mode

• PWD (optional): The password that is defined in the ObserveIT Web Console (default ""). For example: PWD="".

• INSTALLDIR (optional): Use to specify the Agent installation directory.

• WINSRVPORT (optional): Use for Agent API communication in case the default port 5050 is not available.

• JWTFILE "C:\temp\settings.json" specifies the full path to the JWT file - UNC path isn't acceptable.

• ARPSYSTEMCOMPONENT= "1" (optional): Use to hide the ObserveIT Agent from the Add/Remove window in Control Panel.

• /LEO: Logging with errors only, other options include: /L*VX log.txt

For installation with Proxy server:

From version 7.12.4, use the following for Proxy server installation:

• PROXY_ENABLE=1

• PROXY_HOSTNAME=""

• PROXY_PORT=""

• PROXY_USER_CREDENTIALS=1 (enabled) or 2 (not enabled)

  If PROXY_USER_CREDENTIALS is 1 (enabled) then the following are required:

  • PROXY_USERNAME=""

  • PROXY_PASSWORD=""

• If PROXY_USER_CREDENTIALS is 1 (enabled) then the following is optional:

  • PROXY_DOMAIN=""

In version 7.12.3, when PROXY_DEFAULT_CREDENTIALS=0, PROXY_DOMAIN and PROXY_USERNAME are required.
PROXY_ENABLE=1, PROXY_HOSTNAME="", PROXY_PORT="", PROXY_DEFAULT_CREDENTIALS=0