Agent Services via CLI Utility

This section describes how to deploy the SonicWall Endpoint Security (SES) Agent to managed endpoints using the Windows Installer (MSI) command-line interface. Administrators can use the commands below in scripts, Group Policy Objects (GPOs), software distribution tools, or any other enterprise deployment mechanism that supports MSI-based installations.

Users can check the Agent Status and the installation token validation via CLI utility.

Prerequisites

Before running any of the installation commands, ensure the following requirements are met:

• You have obtained the SES MSI installer file from the SonicWall portal or your authorized distribution source.

• You have a valid Installation Token generated from the SonicWall management console.

• The target endpoint meets the minimum system requirements for the SES Agent.

• The account used to run the installer has local administrator privileges on the target machine.

For the Agent installation

All installations require two mandatory inputs: the path to the SES MSI file and a valid Installation Token. Replace the placeholder values in the commands below with the actual file path and token before executing.

Standard Installation (Basic UI with Cancel Button):This is the recommended command for most enterprise deployments. It displays a Basic UI progress dialog to the end user and includes a Cancel button that allows the user to abort the installation if necessary.

Open the Command Prompt via Administrator, type the command msiexec.exe /q /i <installer.msi> INSTALLTOKEN=<install token> to install the Agent.

Installation Without Cancel Button (Basic UI, No Cancel): Use this command when you want to display a progress dialog to the user but prevent them from cancelling the installation mid-process. The /qb! flag suppresses the Cancel button while still showing a Basic UI progress bar.

Open the Command Prompt via Administrator, type the command msiexec.exe /i <installer.msi> /qb! INSTALLTOKEN=<install token> to install the Agent.

Displaying a Basic UI progress dialog (using /qb or /qb!) is strongly recommended. SonicWall does not recommend using the /qn flag for SES deployments.

To check the agent status

Open the Command Prompt via Administrator, type the command TheronUtil.exe status to check the Agent Status.

To validate the agent installation token

Open the Command Prompt via Administrator, type the command TheronUtil.exe token validate -- token " enter the token" to validate the installation token.

For the Agent un-installation

Uninstalling the SES Agent requires administrator privileges. Run the following PowerShell commands to look up the installed product, hash the uninstall password, and invoke msiexec with the hashed value:

$Prod = Get-WMIObject -Classname Win32_Product | Where-Object Name -Match 'SonicWall Endpoint Security'
$num = $Prod.IdentifyingNumber
$password = "<password>"
$bytes = [System.Text.Encoding]::UTF8.GetBytes($password)
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$hashBytes = $sha256.ComputeHash($bytes)
$sha256Hash = [System.BitConverter]::ToString($hashBytes).Replace("-", "").ToLower()
Start-Process -FilePath "$Env:ComSpec" -ArgumentList "/c msiexec.exe /x $num /q UNINSTALLPASSWORD=`"$sha256Hash`""

To upgrade the agent

Upgrading the SES Agent requires administrator privileges. Run the following PowerShell commands to hash the uninstall password and invoke msiexec with the new installer package, the hashed password, and the installation token:

$password = "<password>"
$bytes = [System.Text.Encoding]::UTF8.GetBytes($password)
$sha256 = [System.Security.Cryptography.SHA256]::Create()
$hashBytes = $sha256.ComputeHash($bytes)
$sha256Hash = [System.BitConverter]::ToString($hashBytes).Replace("-", "").ToLower()
Start-Process -FilePath "$Env:ComSpec" -ArgumentList "/c msiexec.exe /i <SES MSI file path> /q UNINSTALLPASSWORD=`"$sha256Hash`" INSTALLTOKEN=`"<install token>`""