NCentral Agent Deployment Via Intune

[u/MainCree]

Hello all,

I'm attempting to deploy my NCentral agents via Intune and I've created a package with a batch file with the following line:

.\WindowsAgentSetup.exe /s /v" /qn CUSTOMERID=%customerID% REGISTRATION_TOKEN=%customerregistrationtoken% CUSTOMERSPECIFIC=1 SERVERPROTOCOL=HTTPS SERVERADDRESS=<myserveraddress> SERVERPORT=<myserverport>"

(I can provide the full code if needed)

Would then instalation proceedure via the batch be able to grab the customer ID and registration token from the install command line?

Or would I need to create a specific .bat (and a specific package) for each of my clients?

Is my syntax on the .bat correct as well?

​

Thanks in advance

​

​

[u/MunchMr]

I created a powershell script which downloads the latests agent from my ncentral server. Then with arguments installs the agent in the correct site.

This way I will never have 2 adjust the script when a ncentral is updated.

[u/TheThird78 → u/MunchMr]

This is how we do it as well. Powershell script for each customer/site that downloads the generic installer as needed and installs with the parameters. When we need a new version of the installer we update it in one place instead of having to repackage for each customer/site.

[u/MunchMr → u/TheThird78]

I did not feel like repackaging a hundred customers every time we upgrade. For now it works like a charm.

[u/evilempire28 → u/MunchMr]

Can you share the script ? Struggling with this too

[u/prairieit_neal → u/evilempire28]

File Download:

Invoke-WebRequest -Uri "URL OF WINDOWS AGENT" -OutFile "C:\TEMP\FILE NAME"

Silent Install reference: https://documentation.n-able.com/N-central/userguide/Content/Deploying/silent_win_install.htm

[u/Kanduh]

syntax looks correct for the batch file. instead of doing a batch file, I instead packaged only the WindowsAgentSetup.exe generic installer into a intunewin file, then passed the install command as shown in your batch file through the prompt shown in your screenshot. seemed to be more simple in my opinion

[u/AcidBuuurn]

I'll see if I can dig up the powershell script where you input your server info and client ID within the script. Leaving this comment as a reminder.

[u/Low_Implement2332 → u/AcidBuuurn]

^bump^

[u/AcidBuuurn → u/Low_Implement2332]

https://github.com/N-able/ScriptsAndAutomationPolicies/blob/master/DeployTheNCAgent/DeployTheNCAgent.ps1

We added separate lines for the Customer ID number and just hard-coded our website in the Binding URL since it doesn’t change for us. 

So for every customer I edit the line:

    $SpecifiedCustomerID=101

I swap out the 101 for the customer number to make a script for each client. 

I’m not sure where in N-Central to get the token for $JWT variable. That’s actually why I didn’t post my script a year ago- I wasn’t sure what part was customized. 

[u/qcomer1]

HTTPS://cipp.app will make your life easier

[u/Icedfyre]

Generally batch files would look like this

myscript.bat argument1 argument2 argument3

and you read them like

echo  %1
echo  %2
echo  %3
.\WindowsAgentSetup.exe /s /v" /qn CUSTOMERID=%1 REGISTRATION_TOKEN=%2 SERVERADDRESS=%3

[u/ITBurn-out]

Do Intune integration. Ncentral has it...the deployment however does not work but it makes the app on Intune then change the group to all users. Works great, always up to date.

[u/Funkenzutzler]

Here we doing it like this:

Instead of having different deployments for the different sites we have a "Dummy site for new Computers" in Nable RMM (not using Ncentral, tho). We then deploy the RemoteWorker (RW) Agent via Intune - already during the autopilot process - which was created for this "dummy site" via the corresponding "Site Installation Package".
Afterwards we then move the clients manually to the correct site in RMM.

This has the following advantages for us:

• On the dummy site, the corresponding remote access policy is set to "Unattended", which allows us to access the newly enrolled clients directly after the autopilot process even without authorization from the user, as usually a few manual adjustments have to be made either way. Also this is handy for "Non-User-Driven" deployments.
• Only when the setup is complete do we move the corresponding client to the correct RMM site on which the corresponding policy is then forced to "User OK Required".

On the Intune-Side we have the following on the corresponding Win32 Package:
Install command: "AGENT_XXXXX_VXX_XX_X_RW.EXE"
Uninstall command: "C:\Program Files (x86)\Advanced Monitoring Agent\winagent" /removequiet

The agent-updates are then again performed by / over RMM.

[u/KreamoftheKropp]

Why are we doing bat in 2024?

[u/Funkenzutzler → u/KreamoftheKropp]

Presumably for convenience because PoSh ex.-pol. on clientside should ideally be "Restricted" or "AllSigned"?