DLP Agent installation general overview

Products

Data Loss Prevention Endpoint Suite

Issue/Introduction

DLP Agent installations are mainly comprised of the following 3 categories:

Clean Installation
Upgrade Installation
Hotfix/Patch Installation

This article will cover DLP Agent installation best practices and procedures. The steps may be adapted for automated deployment with management tools such as Symantec ITMS.

Uninstalling the DLP Agent is covered in the following article: Uninstall and remove the Symantec DLP Endpoint Agent

Environment

DLP Agent

Resolution

N.B.

The agent installation should always be done using a local Administrator account that has Admin Approval Mode disabled.

Clean Installation

This applies to installing the DLP Agent on an endpoint machine where the DLP Agent is not currently installed. Ensure that the account used to install is part of the local Administrators group.

Package the desired Agent MSI using the Enforce Console.
1. In the Enforce Console, navigate to System -> Agents -> Agent Packaging
2. Complete the packaging wizard steps.
Extract the files from the zip package you created in step 1.
Open an Administrator command prompt and change directory to the location of the extracted package files.
Execute install_agent.bat

Upgrade Installation

This applies to upgrading an existing agent installation to a newer Release Version or newer Maintenance Pack.

For example, upgrading from 16.1 GA to 16.1 MP2 HF3, or upgrading from version 25.1 GA to 26.1 GA, or 25.1 GA to 25.1 MP1

Package the desired Release or Maintenance Pack Agent MSI using the Enforce Console (see step 1 in the Clean Installation section above)
Extract the files from the zip package created in step 1
Open an Administrator command prompt and change directory to the location of the extracted package files.
Execute upgrade_agent.bat

Hotfix/Patch Installation

This applies to installing a hotfix MSI on an existing agent installation that is on the same Release Version and Maintenance Pack level as the hotfix.

For example, patching from 16.1 GA to 16.1 GA HF1, or patching 25.1 MP1 to 25.1 MP1 HF1

When you receive a hotfix MSI package, it will typically have a name similar to one of the following examples:
1. AgentInstall-x64_16_1.msi
2. AgentInstall-x64_25_1.msi
  1. N.B. Take note of the actual MSI file name you used to deploy the currently installed agent. For example, if you used "AgentInstall-x64_16_1_MP2.msi" to deploy the existing agent, you need to use that exact same name in the <MSI_Filename>.msi token in the patch_agent.bat file below or the patch installation will fail.
Create a patch_agent.bat file using Windows Notepad with the following command line, replace the <MSI_Filename>.msi token with the correctly determined name as discussed above - in most cases you will not change the file name.
```
msiexec /i <MSI_Filename>.msi /q LOGDETAILS="Yes" /L*v %SystemDrive%\patchAgent.log REINSTALL=ALL REINSTALLMODE=vomus
```
Place the Agent MSI file containing the fixes you need to deploy into the same directory with the patch_agent.bat file.
Open an Administrator command prompt and change directory to the location of the MSI and patch_agent.bat file.
Execute patch_agent.bat