Silent & Mass Deployment via Active Directory (Pre-Authorized MSI Package)

1. Overview

For enterprise customers managing large Windows endpoint fleets, the pre-authorized MSI installer is the recommended deployment method for both USB Disk Security and PrivateDLP. Unlike the EXE installer which requires manual license activation on every device, the enterprise MSI package is pre-embedded with your organization’s subscription authorization, enabling fully silent, zero-user-interaction installation at scale.

When deployed via Active Directory Group Policy, the client installs automatically on target domain devices during system startup. Once installed and connected to the internet, the endpoint automatically registers, activates its license, and binds to your enterprise web management console with no end-user action required. Administrators can then manage all security policies, audit logs and device status centrally from the web console.

Both product editions follow an identical AD deployment workflow; functional differences between Standard and Pro editions are determined by the license embedded in your provided MSI package.

2. Pre-Deployment Prerequisites

Before starting deployment, confirm your environment meets all the following requirements:

• Active Directory Environment: A functioning Windows Active Directory domain, with domain controllers running Windows Server 2016 or later.

• Administrator Permissions: Domain Admin or equivalent permissions to create, configure and link Group Policy Objects (GPOs).

• Pre-Authorized MSI Installer: The official enterprise MSI installation package provided to paid customers, pre-integrated with your organization’s license authorization. Trial users do not have access to pre-authorized MSI packages.

• Network Share: A centrally accessible network shared folder (hosted on a domain server or DFS share) that all target domain devices have read access to.

• Endpoint Requirements:

  • Target devices are domain-joined Windows endpoints (Windows 7/10/11, Windows Server 2016 and later).

  • Endpoints have stable internet access to reach the authorization and synchronization servers.

  • No conflicting endpoint security software that blocks MSI software deployment or system-level security drivers.

• Admin Console Access: Your organization’s web admin console has been activated via Google sign-in at Login page.

3. Step 1: Prepare the MSI Installation Package & Network Share

First, stage the installer in a shared location accessible to all target endpoints:

1. Create a dedicated shared folder on your domain server (e.g., \\your-domain.local\SoftwareDeploy\PrivateDLP).

2. Copy the pre-authorized MSI installer file into the shared folder.

3. Configure share permissions: Grant Read access to the Authenticated Users group (or a dedicated security group containing all target devices).

4. Configure NTFS permissions: Configure matching NTFS file permissions to ensure domain computer accounts (Domain Computers or Authenticated Users) can read the installer file during system startup.

5. Important: Do not rename or modify the provided MSI file structure, as alterations may break the embedded license authorization.

4. Step 2: Create a New Group Policy Object

1. On your domain controller, open the Group Policy Management Console (GPMC).

2. In the left navigation pane, locate the Organizational Unit (OU) containing your target endpoint devices.

3. Right-click the target OU and select Create a GPO in this domain, and Link it here....

4. Name the new GPO (e.g., PrivateDLP Client Deployment) and click OK.

5. Step 3: Configure Silent Software Installation Policy

Edit the GPO to configure automated, unattended MSI deployment:

1. Right-click the newly created GPO and select Edit to open the Group Policy Management Editor.

2. Navigate to Computer Configuration > Policies > Software Settings > Software installation.

3. Right-click Software installation, select New > Package....

4. In the file browser, enter the full UNC network path of the MSI installer (e.g., \\your-domain.local\SoftwareDeploy\PrivateDLP\PrivateDLP_Client.msi) and click Open.

   • Critical: Always use the full UNC path, not a local drive path (like D:\...), to ensure all endpoints can locate the installer across the network.

5. In the Deploy Software dialog, select Assigned as the deployment method, then click OK.

6. Right-click the newly added software package, select Properties, and navigate to the Deployment tab:

   • Confirm the Deployment type is set to Assigned.

   • Under Installation user interface options, keep the default Maximum (Do not select Basic. Since GPO deployment runs during system startup under the SYSTEM context, the installation is natively fully silent with zero user-facing windows or prompts. Selecting Basic can cause the SYSTEM service to hang on certain Windows versions).

7. Click OK to save the package configuration.

6. Step 4: Scope Deployment & Validate GPO Permissions

1. Return to the Group Policy Management Console.

2. Select the GPO you created, and navigate to the Scope tab.

3. Under Security Filtering, configure your target device scope:

   • For full OU deployment: Keep the default Authenticated Users filter to apply the policy to all devices in the linked OU.

   • For targeted pilot deployment: Remove Authenticated Users, add a dedicated domain security group containing only test devices, and grant the group Read and Apply Group Policy permissions.

4. Confirm the GPO is linked to the correct OU containing your target endpoints.

7. Step 5: Trigger Deployment & Verify Successful Onboarding

7.1 Client-Side Deployment Trigger

By default, the software installs automatically when the target endpoint restarts. To force immediate deployment without a full reboot:

1. Log on to a target domain device as a local administrator.

2. Open an elevated Command Prompt.

3. Run the command: gpupdate /force /boot

4. The device will apply the updated group policy and initiate the silent installation.

7.2 Local Installation Verification

To confirm successful deployment on a client device:

1. Open Settings > Apps > Installed apps (or Programs and Features in Control Panel).

2. Verify that USB Disk Security or PrivateDLP appears in the installed programs list.

3. Open the Services console (services.msc) and confirm the corresponding client service is running.

7.3 Automatic Console Binding Verification

No manual activation is required for pre-authorized MSI deployments. To confirm automatic onboarding:

1. Log in to your enterprise web admin console at login page.

2. Navigate to the Home Overview page and open the Device List.

3. Confirm the newly deployed endpoint appears in the list with:

   • Status: Online (after the first heartbeat sync completes)

   • Subscription: Active, with your enterprise subscription validity period

   • No additional license configuration is required for the endpoint.

8. Core Advantages of Pre-Authorized MSI AD Deployment

• Zero Manual Activation: The embedded enterprise license eliminates per-device activation steps. Endpoints automatically register and activate on first network connection.

• Fully Silent Deployment: No user interaction, no setup wizard, and no pop-up notifications during installation, avoiding disruption to end-user productivity.

• Centralized Unified Management: All deployed endpoints automatically bind to your organization’s single admin console, enabling fleet-wide policy management and full security visibility.

• Scalable Domain-Wide Rollout: Supports deployment to hundreds or thousands of endpoints via OU structure, with granular scoping via AD security groups.

• Consistent Version Control: Ensures all endpoints run the same approved client version, simplifying maintenance and compliance audits.

9. Deployment Best Practices

• Always Wait for Network at Startup: To prevent modern Windows 10/11 fast-boot features from skipping GPO installation before the network initializes, we highly recommend enabling the following GPO setting in your domain environment:

  • Path: Computer Configuration > Policies > Administrative Templates > System > Logon

  • Setting: Always wait for the network at computer startup and logon -> Set to Enabled.

• Run a Pilot First: Deploy the GPO to a small test OU with 3–5 devices first to validate installation, console binding and policy synchronization before full enterprise rollout.

• Secure the Installer Share: Grant only read permissions to the shared MSI folder to prevent unauthorized modification of the installer file.

• Align Deployment with AD OU Structure: Organize endpoints by department, device type or location in AD to enable granular, phased deployment and targeted policy management.

• Manage Upgrades via GPO: Use GPO's native "Upgrades" feature to deploy newer versions of the MSI. Do not simply overwrite the file in the network share with a different version or name, as this will break active GPO paths.

• Schedule Off-Peak Deployment: For active production devices, plan rollout during maintenance windows, as software installation requires a system restart to take effect.

• Avoid Version Conflicts: Do not deploy the EXE version and MSI version of the software to the same device simultaneously. Uninstall any existing EXE client before MSI GPO deployment.

10. Common Troubleshooting

10.1 Software Does Not Install on Target Devices

• Verify the GPO is linked to the correct OU containing the target device computer accounts (not user accounts).

• Run gpresult /r on the endpoint (under Administrator Command Prompt) to confirm the deployment GPO is successfully applied to the computer account.

• Confirm the UNC path of the MSI file is accessible from the target device, and the device account has read permissions to the shared folder (test access by opening the UNC path in Windows Explorer under the SYSTEM or Local Admin account).

• Confirm the target device has restarted after GPO assignment, as software installation runs during computer startup.

• Verify that the "Always wait for the network at computer startup and logon" policy is enabled (see Section 9).

10.2 Installed Device Does Not Appear in the Admin Console

• Confirm the endpoint has stable internet access and can reach the official authorization servers.

• Verify you are using the official pre-authorized MSI package provided for your organization; trial or third-party MSI packages do not support automatic console binding.

• Restart the client service on the endpoint (via services.msc) to trigger a new registration heartbeat.

• Confirm your enterprise subscription is active and has available device seats.

10.3 Installation Fails with Error Code

• Open Windows Event Viewer on the target endpoint, navigate to Windows Logs > Application, and filter for MsiInstaller events to view detailed error codes.

• Common causes: Insufficient system permissions, conflicting third-party security software, or a corrupted MSI installer file. Re-download the official MSI package and re-stage the shared file.

10.4 License Shows as Expired on the Endpoint

• Confirm your enterprise subscription is active and has not lapsed.

• Verify the MSI package matches your current subscription tier (Standard vs. PrivateDLP Pro).

• Contact your account support team to regenerate an updated pre-authorized MSI package if your license has been renewed.