Introduction

This is a guide to deploying the Quickpass Agent via Microsoft Group Policy for On Premise Active Directory Environments.

Prerequisites

• Customers created in the Quickpass Dashboard
  • via ITGlue
  • via Hudu
  • via ConnectWise Manage
  • Manual Creation
• Group Policy Understanding
• Domain Admin rights to the Domain you are configuring the Group Policy
• A copy of a PowerShell script that you know works for your customer.
  • You can use the one from our KB as a guide and modify the appropriate values.
    Sample PowerShell Script 
  • Your PowerShell Script will have to have the InstallToken and AgentID IDs hard coded PER Customer
  • Ensure that you have reviewed and understand the Install Token and Agent ID Values
    https://support.getquickpass.com/hc/en-us/articles/360061942274-Export-Customers-List-Status-and-Agent-ID-s
  • Review the Scripted Agent Installation KB Article to understand what each Powershell Parameter will do
    https://support.getquickpass.com/hc/en-us/articles/4413576799639-Scripted-Agent-Installation
• This process describes how to use the "System" Account to Install as Administrator however any account can be used that has Administrator Privileges.

Implementation

Prepare the script

1. Create a PowerShell script and test it on an AD Workstation or AD Member to ensure that your hardcoded values will work in your customer environment
2. Copy that script to a File Share or use a GPO Startup Script Location
   1. If using a File Share make sure that the DOMAIN COMPUTERS security group has access to that Share and Folder
   2. You can use the SysVOL share which all Domain joined systems have access to.  See the Group Policy section (Step 7) below for these instructions.

Adding a Task to Push to Domain Systems

1. Log on to a Domain Controller as a Domain Admin
2. Open the Group Policy Management Console for the Domain
3. Decide what OU level you want this to be configured for
   1. You can use a Sub OU to run a test on a sample set of Computers (this is a Computer Based Group Policy) or you can set the Policy at the Root of the Domain and specify a Security Group Containing the computers you want to trial this for.
   2. Once your Proof of Concept has been confirmed to work, then you can add the Group Policy to other OUs or add additional computers to the Defined Security Group
4. Right click the location you want to start configuring this Policy on and select "Create a GPO in this Domain and Link it Here
   
5. Name the GPO something appropriate for what you are trying to accomplish
   
6. Right Click that new GPO that you created and Select Edit
7. If you want to use the SysVol location to store the PowerShell script to execute, please follow these steps.  If using a FileServer/Shared Folder please move on to Step 8
   1. Expand Computer Configuration -> Policies -> Windows Settings -> Scripts (Startup/Shutdown)
   2. Double Click Startup
   3. Click Show Files
   4. Paste the tested script into this Folder
   5. Hold Shift and Right Click the Script you just pasted
      1. Select Copy as Path (save this for step 11.3) or paste into Notepad (or similar) to ensure you have the full script location
         
      2. DO NOT link the Script to the Policy, simply save the PowerShell File in that location.
8. Expand Computer Configuration -> Preferences -> Control Panel Settings -> Scheduled Tasks
   
9. Right Click on Scheduled Tasks and select New -> Immediate Task (At least Windows 7)
   
10. Populate the following Values
    1. Name - Give the Task a Name (Required Value)
    2. Description - Describe what the Task Does (Optional)
    3. Security Options
       1. Click Change User or Group
       2. Type in System -> Click OK
       3. Select Run whether user is logged on or not
       4. Check the "Run with Highest Privileges" box
11. Select the Actions Tab
    1. Click NEW
       1. Select Start a Program (usually this is the default)
       2. In the Program/Script box type - PowerShell.exe
       3. In the Add Arguments box type:

          -ExecutionPolicy Bypass -command "& 'PATHTOSCRIPT\Scriptname.ps1'"

          1. Change PATHTOSCRIPT to the location of the PowerShell Script
             1. ex \\servername\share
             2. ex '\\domain.local\SysVol\domain.local\Policies\{E0717B59-A69E-4915-A40E-424DA4537237}\Machine\Scripts\Startup\QPInst.ps1'"
          2. Change Scriptname.ps1 to the name of the script
    2. Click OK
12. You can define Conditions if you want to on the Conditions Tab
13. Click the Settings Tab
    1. Check the "Allow task to be run on Demand" if you want the task to able to be executed by the System's Scheduled Task Panel
    2. It is suggested to NOT check the "If the task fails, restart every" box.
    3. Check the "Stop the task if it runs longer than:" and set the interval to 1 hour
       1. You don't want the task running for that long
    4. Check the "If the running task does not end when requested, force it to stop"
       1. This will terminate the process if it is stuck.
    5. Set the "If the task is already running, then the following rule applies" section to "Do not start a new instance"
14. Click the Common Tab
    1. Click the "Apply once and do not reapply" box
       1. This prevents the installation from repeatedly trying to install.
15. Click OK
16. Now you will want to test on a sample set of workstations or servers.
    1. Create a Security Group and add a few Computers to that Group (remember this Policy applies to the Computer not the user)
    2. In the Security Filtering section of the Policy you just created click ADD and add that newly created Group to the list.
       1. Once you have tested that this works on those machines, you can remove the Group entirely from the Security Filtering List or add additional machines to the Group.

Troubleshooting

1. If there is an error in your syntax or if the task executes but doesn't install the agent, remove the task from the machine and run a GPUPDATE /Force on the system to force the task to execute again.