Install Arctic Wolf Agent in a persistent VDI environment

You can install the Arctic Wolf® Agent in a persistent VDI environment.

Note:

Agent is designed to maintain a minimal footprint on all systems, but Arctic Wolf recommends some OS requirements. Arctic Wolf cannot guarantee functionality on virtual machine (VM) environments if resources do not meet recommended levels.
Agent does not support ARM architecture.
Windows 8.1, 8, 7, and Windows Server 2008 R2 are only supported on Agent version 2023-02_138.

These resources are required:

Administrator permissions or the ability to do administrator or root level functions
One of these operating systems:
- Windows 11 for 64-bit systems
- Windows 10 Pro for 64-bit and 32-bit systems
- Windows Server 2025, 2022, 2019, 2016, 2012 R2, or 2012 for 64-bit systems
- Windows 11 IoT or Windows 10 IoT for 64-bit systems
- If you plan to use Sysmon with Agent, Sysmon has these operating system requirements:
  - Windows 10 or newer for 64- and 32-bit systems
  - Windows Server 2016 or newer for 64-bit systems
These system resources:
- A x64 or x86 processor
- At a minimum:
  - A dual-core CPU
  - 2 GB of memory
  - 50 MB of disk space

To install Sysmon for Agent on Windows, see Install Sysmon on Windows devices. Sysmon is a Microsoft product that provides detailed information about processes, file systems, and network activity. When installed on Windows endpoints, Sysmon helps Agent detect endpoint activity for the MDR service.
To install the Agent Containment Driver, see Install the Arctic Wolf Agent Containment Driver on Windows using the Arctic Wolf Unified Portal. Containment is a feature of our MDR service that allows Arctic Wolf to isolate network traffic on the Windows Agent host.

Configure your environment firewall

Configure your firewall to allow traffic to Agent DNS hostnames.

Sign in to the Arctic Wolf Unified Portal.
In the navigation menu, click Resources > Allowlist Requirements.
Configure your firewall to allow outbound traffic for all the hostnames, not IP addresses, listed in the Agent section.

Note:
Agent must contact Arctic Wolf servers to register. If this process fails, Agent retries every 15 seconds. This has no negative effect on the system.

VBScript must be enabled to install Arctic Wolf Agent.

If you have disabled VBScript, you must re-enable this Windows feature.

Go to Start > Settings > System > Optional features.
Select View features.
In the search dialog, enter VBSCRIPT, and then select the check box for the VBScript search result.
To enable the VBScript feature, click Next.

Run this command to install Agent:

SHELL

msiexec /i awn-agent.msi /l*v install.log

msiexec /i awn-agent.msi /l*v install.log