48 lines
1.8 KiB
PowerShell
48 lines
1.8 KiB
PowerShell
param(
|
|
[string]$Binary = ".\bin\sessionguard-agent.exe",
|
|
[string]$Config = ".\configs\agent.json",
|
|
[string]$GmsaAccount = ""
|
|
)
|
|
$ErrorActionPreference = 'Stop'
|
|
$service = 'SessionGuardAgent'
|
|
$dest = 'C:\Program Files\SessionGuard'
|
|
$data = 'C:\ProgramData\SessionGuard'
|
|
New-Item -ItemType Directory -Force -Path $dest,$data | Out-Null
|
|
|
|
$existing = Get-Service -Name $service -ErrorAction SilentlyContinue
|
|
if ($existing -and $existing.Status -ne 'Stopped') {
|
|
Stop-Service -Name $service -Force
|
|
$existing.WaitForStatus('Stopped', [TimeSpan]::FromSeconds(20))
|
|
}
|
|
|
|
Copy-Item $Binary "$dest\sessionguard-agent.exe" -Force
|
|
if (Test-Path $Config) {
|
|
Copy-Item $Config "$data\agent.json" -Force
|
|
} elseif (-not (Test-Path "$data\agent.json")) {
|
|
throw "Config '$Config' does not exist and no existing $data\agent.json was found."
|
|
}
|
|
|
|
# Protect credentials, enrollment material and the persisted per-agent token/state.
|
|
icacls $data /inheritance:r /grant:r 'SYSTEM:(OI)(CI)(F)' 'Administrators:(OI)(CI)(F)' | Out-Null
|
|
if ($GmsaAccount) {
|
|
icacls $data /grant "$GmsaAccount`:(OI)(CI)(F)" | Out-Null
|
|
}
|
|
|
|
if (-not $existing) {
|
|
& "$dest\sessionguard-agent.exe" -config "$data\agent.json" -service install
|
|
}
|
|
|
|
# Enterprise service defaults: delayed start and automatic recovery after crashes.
|
|
& sc.exe config $service start= delayed-auto | Out-Null
|
|
& sc.exe failure $service reset= 86400 actions= restart/5000/restart/15000/restart/60000 | Out-Null
|
|
& sc.exe failureflag $service 1 | Out-Null
|
|
|
|
if ($GmsaAccount) {
|
|
# gMSA accounts are specified as DOMAIN\name$ and use an empty service password.
|
|
& sc.exe config $service obj= $GmsaAccount password= "" | Out-Null
|
|
}
|
|
|
|
Start-Service -Name $service
|
|
Write-Host "SessionGuard Agent installed/updated and started."
|
|
if ($GmsaAccount) { Write-Host "Service identity: $GmsaAccount" } else { Write-Host "Service identity: LocalSystem" }
|