SentinelOne Agent Deployment: EDR Installation and

# Check file hash against console-provided SHA256
$installerPath = "C:\Temp\SentinelInstaller_windows_64bit.msi"
$hash = Get-FileHash -Path $installerPath -Algorithm SHA256
Write-Host "SHA256: $($hash.Hash)"
# Compare with hash shown in console Downloads page

# List installed security products
Get-WmiObject -Namespace "root\SecurityCenter2" -Class AntiVirusProduct |
    Select-Object displayName, productState
 
# Common conflicts: McAfee, Symantec, Trend Micro, CrowdStrike
# Windows Defender will be automatically managed by SentinelOne

# Check disk space (need 2GB+)
Get-PSDrive C | Select-Object @{N="FreeGB";E={[math]::Round($_.Free/1GB,2)}}
 
# Check RAM (need 2GB+)
[math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory/1GB,2)
 
# Check OS version
Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version

# Replace with your console hostname
Test-NetConnection -ComputerName "\<tenant\>.sentinelone.net" -Port 443

# Define parameters
$installerPath = "C:\Temp\SentinelInstaller_windows_64bit.msi"
$siteToken = "<your-site-token>"
$logPath = "C:\Temp\SentinelOne-Install-$(Get-Date -Format 'yyyyMMdd').log"
 
# Execute installation
$process = Start-Process msiexec.exe -ArgumentList @(
    "/i `"$installerPath`""
    "/qn"
    "SITE_TOKEN=`"$siteToken`""
    "/l*v `"$logPath`""
) -Wait -PassThru -NoNewWindow
 
# Check result
if ($process.ExitCode -eq 0) {
    Write-Host "[SUCCESS] Installation completed" -ForegroundColor Green
} elseif ($process.ExitCode -eq 3010) {
    Write-Host "[SUCCESS] Installation completed - reboot required" -ForegroundColor Yellow
} else {
    Write-Host "[ERROR] Installation failed: Exit code $($process.ExitCode)" -ForegroundColor Red
    Write-Host "Review log: $logPath"
}

# Wait for service to start (up to 2 minutes)
$maxAttempts = 24
$attempt = 0
 
do {
    $service = Get-Service -Name "SentinelAgent" -ErrorAction SilentlyContinue
    if ($service -and $service.Status -eq "Running") {
        Write-Host "[SUCCESS] SentinelAgent service is running" -ForegroundColor Green
        break
    }
    Start-Sleep -Seconds 5
    $attempt++
    Write-Host "Waiting for service... ($attempt/$maxAttempts)"
} while ($attempt -lt $maxAttempts)

# Check registry configuration
$regPath = "HKLM:\SOFTWARE\SentinelOne\Sentinel Agent"
if (Test-Path $regPath) {
    $config = Get-ItemProperty -Path $regPath
    Write-Host "Management Server: $($config.ManagementServerUrl)"
    Write-Host "Site ID: $($config.SiteId)"
    Write-Host "Agent ID: $($config.AgentId)"
}
 
# Check agent version
$agentExe = Get-ChildItem "C:\Program Files\SentinelOne" -Recurse -Filter "SentinelAgent.exe" | Select-Object -First 1
Write-Host "Agent Version: $($agentExe.VersionInfo.FileVersion)"

function Test-SentinelOneAgent {
    Write-Host "`n=== SentinelOne Agent Verification ===" -ForegroundColor Cyan
 
    $results = @{}
 
    # Check 1: Service status
    $service = Get-Service -Name "SentinelAgent" -ErrorAction SilentlyContinue
    if ($service -and $service.Status -eq "Running") {
        Write-Host "[PASS] Service running" -ForegroundColor Green
        $results.Service = $true
    } else {
        Write-Host "[FAIL] Service not running" -ForegroundColor Red
        $results.Service = $false
    }
 
    # Check 2: Process running
    $process = Get-Process -Name "SentinelAgent" -ErrorAction SilentlyContinue
    if ($process) {
        Write-Host "[PASS] Process active (PID: $($process.Id))" -ForegroundColor Green
        $results.Process = $true
    } else {
        Write-Host "[FAIL] Process not found" -ForegroundColor Red
        $results.Process = $false
    }
 
    # Check 3: Registry configuration
    $regPath = "HKLM:\SOFTWARE\SentinelOne\Sentinel Agent"
    if (Test-Path $regPath) {
        $config = Get-ItemProperty -Path $regPath
        Write-Host "[PASS] Registry configured" -ForegroundColor Green
        Write-Host "  - Server: $($config.ManagementServerUrl)" -ForegroundColor Cyan
        $results.Registry = $true
    } else {
        Write-Host "[FAIL] Registry not configured" -ForegroundColor Red
        $results.Registry = $false
    }
 
    # Check 4: Console connectivity
    try {
        $consoleUrl = (Get-ItemProperty -Path $regPath).ManagementServerUrl
        $consoleHost = ([System.Uri]$consoleUrl).Host
        $connection = Test-NetConnection -ComputerName $consoleHost -Port 443 -WarningAction SilentlyContinue
        if ($connection.TcpTestSucceeded) {
            Write-Host "[PASS] Console connectivity verified" -ForegroundColor Green
            $results.Connectivity = $true
        } else {
            Write-Host "[FAIL] Cannot reach console" -ForegroundColor Red
            $results.Connectivity = $false
        }
    } catch {
        Write-Host "[FAIL] Connectivity check failed" -ForegroundColor Red
        $results.Connectivity = $false
    }
 
    # Summary
    $passed = ($results.Values | Where-Object { $_ }).Count
    $total = $results.Count
 
    Write-Host "`n=== Summary: $passed/$total checks passed ===" -ForegroundColor Cyan
 
    return ($passed -eq $total)
}
 
Test-SentinelOneAgent

# Check installation log
Select-String -Path "C:\Temp\SentinelOne-Install*.log" -Pattern "error|failed" -Context 2,3
 
# Check agent log
Get-Content "C:\ProgramData\SentinelOne\Logs\Agent.log" -Tail 50
 
# Check Windows Event Log
Get-WinEvent -LogName Application -MaxEvents 20 |
    Where-Object { $_.ProviderName -like "*Sentinel*" }
 
# Test network connectivity
Test-NetConnection -ComputerName "\<tenant\>.sentinelone.net" -Port 443 -InformationLevel Detailed

# Get product code
$product = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*SentinelOne*" }
 
# Uninstall
msiexec /x $product.IdentifyingNumber /qn /l*v "C:\Temp\sentinel-uninstall.log"
 
# Wait and reboot
Start-Sleep -Seconds 30
Restart-Computer
 
# Reinstall with correct token after reboot