Skip to content
LEGIT AIDOCS
Open the console

Deploy to many machines

Install the Windows agent across a fleet with Group Policy or Microsoft Intune, from a file share or from the platform itself.

The installer is safe to run more than once: on a machine where the agent is already installed it keeps the same agent ID and upgrades in place. That is what lets a policy run it on every machine, every time.

Both ways use an enrollment token from Admin → Endpoints → Add endpoint → Generate enrollment command. One token serves any number of machines; revoke it there once the rollout is done.

Group Policy, from a file share

Section titled “Group Policy, from a file share”

  1. In the same window, choose Download the offline package (.zip) and unpack it on a share every computer can read, such as \\fileserver\legit-agent$. It holds agent.exe, install_windows.ps1, the Sysmon settings and a README.

  2. In the Group Policy Management Editor, open Computer Configuration → Policies → Windows Settings → Scripts (Startup/Shutdown) → Startup, and on the Scripts tab (not PowerShell Scripts) add:

    Field Value
    Script Name powershell.exe
    Script Parameters -NoProfile -ExecutionPolicy Bypass -File \\fileserver\legit-agent$\install_windows.ps1 -ServerUrl "https://legit.corp.internal" -EnrollmentToken "<token>"

  3. Link the policy to the organisational units of the computers to enrol. Each one installs the agent at its next start, as SYSTEM, from the share — nothing is downloaded.

Microsoft Intune

Section titled “Microsoft Intune”

Intune runs a script as SYSTEM on each device; the script fetches the installer and the agent from your platform.

  1. Save the one-line command from Add endpoint as legit-agent.ps1.

  2. In the Intune admin centre, open Devices → Scripts and remediations → Platform scripts → Add → Windows 10 and later, upload the file and set:

    Setting Value
    Run this script using the logged on credentials No
    Enforce script signature check No
    Run script in 64 bit PowerShell Host Yes

  3. Assign it to the device groups to enrol.

The devices need HTTPS to the platform’s address.

See them arrive

Section titled “See them arrive”

Admin → Endpoints lists each machine as it registers, with whether its collectors are running.