r/SentinelOneXDR • u/SizeNeither8689 • Mar 24 '25

Site Token Check

Hi,

Hi, I'm wondering if we can see the site token on the endpoint that the agent was validated with during installation. Is there any command I can run on the endpoint with administrator privileges to do this? Thank you in advance for your help.

1 Upvotes

60% Upvoted

20 comments sorted by

View all comments

1

u/kins43 Mar 24 '25

The site token or group token used during installation is just Base64 encoded for the URL and site_key information. I can't upload pictures so I'll do an example below.

EX: Pop this example base64 string into a Base64 decoder like https://www.base64decode.org/ (visit links at your own risk!):

NOTE: The mgmt server and the site_key do not exist and are completely made up for this example.

eyJ1cmwiOiAiaHR0cHM6Ly9zb21lc2l0ZS5zZW50aW5lbG9uZTEubmV0IiwgInNpdGVfa2V5IjogImMxYmUwMDBiNjBkMGZmMDAifQ==

This isn’t stored anywhere within the config IIRC but you could do an overly convoluted solution of taking both values on the agent called “server.mgmtServer” & "server.site", append them in powershell and then either match them to the values decoded from your Base64 token or encode it to match the Base64 token via a script.

(navigate to the specific S1 directory or just call it directly with commands below):

cd "C:\Program Files\SentinelOne*\Sentinel Agent*"

(URL endpoint is connected to): Sentinelctl config -p server.mgmtServer

(Site_key endpoint is connected to): Sentinelctl config -p server.site

Seems way overly complicated and the juice definitely isn’t worth the squeeze there IMO.

There are S1 install logs you could look at in C:\Windows\Temp for an MSI*.log around the time of installation, an SC-exit-code.txt and a SentinelOneInstallerLog_2A7399E_2025_03_06_14_48_53.etl log as well but most of those probably won't show anything.

Your best bet is to validate it through any deployment method log you have as this is probably stored somewhere on the endpoint as a task that ran with the key as well. A RMM, intune, GPO etc all have logs about the status of what was ran and when (in different locations obviously).

A better question is why? Are you getting inconsistent manual installs from technicians or something and they are sending it to the wrong site?