Install Arctic Wolf Agent in a non-persistent VDI environment

You can install the Arctic Wolf® Agent in a non-persistent VDI environment.

Arctic Wolf Agent supports non-persistent virtual desktop infrastructure (VDI) using these VDI solutions:

VMware Horizon
Citrix
Windows Remote Desktop Services

You can use this to create a master template to deploy non-persistent Windows VDI instances. This resolves issues like duplicate Agent UUIDs and allows for better management of non-persistent Windows instances.

Any non-persistent VDI instances created from this template are:

Identified in the Arctic Wolf Unified Portal with VDI State attributes.
Not added to scan groups automatically.
Not updated automatically.
Deactivated in the Arctic Wolf Portal within three days, rather than 90 days for persistent images.

Note: When set up correctly, you will have one online non-persistent VDI device. Duplicate offline devices are automatically purged after three days. If duplicate non-persistent VDI devices appear in the Arctic Wolf Unified Portal, install Arctic Wolf Agent for non-persistent VDI instances again.

These resources are required:

One of these operating systems:
- Desktop
  - Windows 11 or 10
- Server
  - 2022, 2019, 2016, or 2012 R2
Arctic Wolf Agent version 2023-01 or later

To install Sysmon for Agent on Windows, see Install Sysmon on Windows devices. Sysmon is a Microsoft product that provides detailed information about processes, file systems, and network activity. When installed on Windows endpoints, Sysmon helps Agent detect endpoint activity for the MDR service.
To install the Agent Containment Driver, see Install the Arctic Wolf Agent Containment Driver on Windows using the Arctic Wolf Unified Portal. Containment is a feature of our MDR service that allows Arctic Wolf to isolate network traffic on the Windows Agent host.

Configure your environment firewall

Configure your firewall to allow traffic to Agent DNS hostnames.

Sign in to the Arctic Wolf Unified Portal.
In the navigation menu, click Resources > Allowlist Requirements.
Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.

Note:
Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

Enable VBScript

VBScript must be enabled to install Arctic Wolf Agent.

If you have disabled VBScript, you must re-enable this Windows feature.

Go to Start > Settings > System > Optional features.
Select View features.
In the search dialog, enter VBSCRIPT, and then select the check box for the VBScript search result.
To enable the VBScript feature, click Next.

Create the initial non-persistent image

On the target endpoint system, run this command with administrator permissions to create the initial non-persistent image:
SHELL
msiexec /i awn-agent.msi VDI_TEMPLATE_IMAGE=1 /l*v install.log
```
msiexec /i awn-agent.msi VDI_TEMPLATE_IMAGE=1 /l*v install.log
```
Using the target endpoint system, create a master template that will be used to create non-persistent VDI instances.

Deploy non-persistent instances using the master template.