Msiexec provides full control over the installation process and allows you to install, modify, and perform operations on a Windows Installer from the command line interface (CLI). You can also use Msiexec to log any issues encountered during installation.
You can also use Msiexec in conjunction with a System Center Configuration Manager (SCCM), Altiris, Group Policy Object (GPO), or other MSI deployment software to install Cortex XDR on multiple endpoints for the first time.
When you install the Cortex XDR agent with Msiexec, you must install the Cortex XDR agent per-machine and not per-user.
Although Msiexec supports additional options, the Cortex XDR agent installers support only the options listed here. For example, with Msiexec, the option to install the software in a non-standard directory is not supported—you must use the default path.
Note
The following parameters apply to the initial installation on the Cortex XDR agent on the endpoint, except for the CLEAN_AGGRESIVLY=1 parameter which should be used during agent upgrade.
/i<installpath>\<installerfilename>.msi—Install a package. For example, msiexec /i c:\install\cortexxdr.msi.
/qn—Displays no user interface (quiet installation).
/L*v <logpath>\<logfilename>.txt—Log verbose output to a file. For example, /l*v c:\logs\install.txt.
VDI_ENABLED=1—Use to install the Cortex XDR agent on the golden image for a non-persistent VDI. This option identifies the session as a VDI in Cortex XDR and applies license and endpoint management policy specific for non-persistent VDI. To set up the Cortex XDR agent on a golden image for non-persistent VDI, see Cortex XDR agent for virtual environments and desktops.Cortex XDR agent for virtual environments and desktops
TS_ENABLED=1—Use to install the Cortex XDR agent on the golden image for a temporary session. This option identifies the session as a temporary session in Cortex XDR and to apply license and endpoint management policy specific for temporary sessions. To set up the Cortex XDR agent on a golden image for temporary sessions, see Cortex XDR agent for virtual environments and desktops.Cortex XDR agent for virtual environments and desktops
proxy_list—Use to install Cortex XDR agents that communicate with Cortex XDR through an application-specific proxy for Cortex XDR. This option is relevant in environments where Cortex XDR agents communicate with Cortex XDR through a proxy, enabling Cortex XDR admins to control and manage the agent proxy configuration settings without affecting the communication of other applications on the endpoint. To set up a Cortex XDR specific proxy, see Configure Cortex XDR specific proxy section below. The Cortex XDR agent does not support proxy communication in environments where proxy authentication is required.
Note
You can also set up a system-wide proxy for all communication on the endpoint.Use Cortex XDR Agent for Windows
RESTRICT_RESPONSE_ACTIONS=1—Use to permanently disable the option for Cortex XDR to perform all, or a combination, of the following actions on endpoints running a Cortex XDR agent: initiate a Live Terminal remote session on the endpoint, execute Python scripts on the endpoint, and retrieve files from the endpoint to Cortex XDR. Disabling any of these actions is an irreversible action, so if you later want to enable the action on the endpoint, you must uninstall the Cortex XDR agent and install a new package without this flag. To disable a specific action, use the corresponding flag:
RESTRICT_LIVE_TERMINAL=1—Use to disable Live Terminal.
RESTRICT_SCRIPT_EXECUTION=1—Use to disable script execution.
RESTRICT_FILE_RETRIEVAL=1—Use to disable files retrieval.
To disable more than one option, use any combination of these flags.
CLEAN_AGGRESIVLY=1—Use to clean the endpoint from a previous Cortex XDR agent installation that was performed in msi Advertise mode. For details, see Cortex XDR Agents Deployed in Advertise Mode.
CONTENT={path}\content-XXX-XXXXX.zip—Use to install the Cortex XDR agent with the downloaded content file to ensure the agent can enforce policies and rules on the endpoint immediately after agent startup. For example, CONTENT=\\sccm\share\Traps\Version740\content-181-58641.zip. You can specify the content path either from the local volume or from a shared directory to which the current logged-in user has access. To understand the benefits, workflow, and requirements to support this type of deployment, refer to Install the Cortex XDR Agent with Installer and Content Update Package.
ENDPOINT_TAGS="Name1,Name2,Name3"—Use to add tags to the endpoint tags.
To install Cortex XDR using Msiexec:
Before installing the Cortex XDR agent on a Windows endpoint, verify that the system meets the requirements described in Cortex XDR Agent for Windows Requirements.
Use one of the following methods to open a command prompt as an administrator.
Select → → . Right-click Command prompt and Run as administrator.
Select Start. In the Start Search box, type cmd. Then, to open the command prompt as an administrator, press CTRL+SHIFT+ENTER.
Run the msiexec command followed by one or more supported options and properties.
For example:
msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn