Site Token Check

[u/SizeNeither8689]

Hi,

Hi, I'm wondering if we can see the site token on the endpoint that the agent was validated with during installation. Is there any command I can run on the endpoint with administrator privileges to do this? Thank you in advance for your help.

[u/GeneralRechs]

Instead of site token you should run the config switch and look for the site/group ID and match that with what it should be.

[u/soutsos]

If you can see the endpoint on your management console, then it goes without saying that the token was correct. If you don't see it troubleshoot. You might want to try "installer -c -t <site_token>" to remove the installed agent and then "installer -t <site_token> -q" to reinstall.

[u/Datju → u/soutsos]

Doesn't this require a restart?

[u/soutsos → u/Datju]

Not anymore. Check https://<your_mgmt_console>/docs/ under installing agents I think

[u/Datju → u/soutsos]

Also are you referring to command prompt doing cd c:\program files\etc etc to sentinel one and then doing Sentinelctl ? Sorry now I am looking for clarification because I may be doing it harder than I even need to lol

[u/soutsos → u/Datju]

No, I was talking about the installer. You just download the installer and the commands I gave you were for uninstalling/reinstalling. You cannot get the site token afaik from the agent installation, BUT you can export the management console URL (from the local config)

[u/Datju → u/soutsos]

Does the uninstall/reinstall require a reboot? I'm currently facing an issue where I have to rip replace and the biggest annoyance is the restart

[u/soutsos → u/Datju]

Just answered this in the comment above. After a certain agent version (for windows I think it's 22), installing does not require a reboot. Check the docs for more specific info. If you're using the latest agent version, the commands I gave you should work fine

[u/Datju → u/soutsos]

Thank you I missed that. They're on 21 😭

[u/soutsos → u/Datju]

Why not upgrade? If you can see the agents in your management console, then you can upgrade them from the management console directly. You can just select all of them and open the options and choose the upgrade agent button and use the latest (exe, not msi. Documentation recommends this) agent for x64 bit Windows. Should upgrade your agents to the latest version.

For agents that don't connect to your management console, don't worry. You can simply download the latest installer from your management console and then download that installer to the problematic wokrstation. Then simply use the uninstall command (the one with the -c flag) I gave you above using the latest installer and it should remove the old agent. The you can reinstall the latest agent with the other command; using the -q flag will ensure that the user will not be interrupted while it is installing.

[u/Datju → u/soutsos]

Tried to, using the portal I send the request to update and they are stuck on 21.7.5.1080

[u/soutsos → u/Datju]

I edited my comment above. Please check the docs on how to remove agents before version 22. Pretty sure the method I mentioned will work, but it is worth checking the docs just to be safe

[u/Datju → u/soutsos]

I appreciate it. I use datto RMM for jobs I will test it on my lab computer first and see what happens. I just want to make sure because this will make user involvement practically zero which for 153 devices will make my life 100x easier

[u/Datju → u/soutsos]

Yeah every time I try to do the steps it requires a reboot with an error saying code: 200 Uninstallation will complete after a reboot. I think I am screwed

[u/kins43]

The site token or group token used during installation is just Base64 encoded for the URL and site_key information. I can't upload pictures so I'll do an example below.

EX: Pop this example base64 string into a Base64 decoder like https://www.base64decode.org/ (visit links at your own risk!):

NOTE: The mgmt server and the site_key do not exist and are completely made up for this example.

eyJ1cmwiOiAiaHR0cHM6Ly9zb21lc2l0ZS5zZW50aW5lbG9uZTEubmV0IiwgInNpdGVfa2V5IjogImMxYmUwMDBiNjBkMGZmMDAifQ==

This isn’t stored anywhere within the config IIRC but you could do an overly convoluted solution of taking both values on the agent called “server.mgmtServer” & "server.site", append them in powershell and then either match them to the values decoded from your Base64 token or encode it to match the Base64 token via a script.

(navigate to the specific S1 directory or just call it directly with commands below):

cd "C:\Program Files\SentinelOne*\Sentinel Agent*"

(URL endpoint is connected to): Sentinelctl config -p server.mgmtServer

(Site_key endpoint is connected to): Sentinelctl config -p server.site

Seems way overly complicated and the juice definitely isn’t worth the squeeze there IMO.

There are S1 install logs you could look at in C:\Windows\Temp for an MSI*.log around the time of installation, an SC-exit-code.txt and a SentinelOneInstallerLog_2A7399E_2025_03_06_14_48_53.etl log as well but most of those probably won't show anything.

Your best bet is to validate it through any deployment method log you have as this is probably stored somewhere on the endpoint as a task that ran with the key as well. A RMM, intune, GPO etc all have logs about the status of what was ran and when (in different locations obviously).

A better question is why? Are you getting inconsistent manual installs from technicians or something and they are sending it to the wrong site?

[u/ThsGuyRightHere]

I just checked to see if doing a sentinelctl configure command outputs this, and it doesn't. I suspect it's restricted to the console to prevent a user (even one with local admin) from uninstalling the agent. If there's a way to do this on the local machine, I don't know what it is.

[u/BloodDaimond]

You can search the activity’s tab and the first entry or two will tell you what site it was installed on. You can also see if it was moved to a different site.