Deploying ThreatLocker with Kaseya VSA

View in browser

Note: For organizations deploying to a large amount of endpoints, ThreatLocker recommends using a staggered deployment approach. Organizations that deploy to a large number of endpoints at once may experience increased bandwidth usage as Windows Core and application definitions are downloaded to each endpoint. QOS can be used to limit bandwidth to corecdn.threatlocker.com and apps.threatlocker.com

Get the latest deployment script for Kaseya VSA from the Deploy Agents section of the Deployment Center in the ThreatLocker Portal. 

Overview

This article will cover the steps to import the ThreatLocker Deployment script into your Kaseya VSA instance.

The script will attempt to match your clients in Kaseya to your Organizations in ThreatLocker, and will create a new Organization if it doesn't match.

It will also place the devices into either the Workstations or Servers group in ThreatLocker dependant on the operating system.

Note: We advise running this against a single PC first as the naming convention in Kaseya can lead to unexpected results.

Creating the Script

Login to your Kaseya VSA.

Navigate to "Agent Procedures" > "Schedule /Create".

Under the "Private" folder, select the "myProcedures" folder.

Select "Import Folder/Procedure".

Upload the XML file (use the camera icon to search) and then select "Save".

The procedure is now imported.

Right-click the procedure, and select "Edit Procedure".

Updating the Procedures

Once imported, expand the ThreatLocker folder to view the two new deployment scripts.  

Select Line 6, and replace the XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX with your unique identifier from ThreatLocker (https://threatlocker.kb.help/general/getting-your-unique-identifier-from-threatlocker/).

How to find your Unique Identifier:

The Key is provided to you by ThreatLocker and can be found by navigating to the Computers page and selecting the "Install New Computer" button. The Unique Identifier is the key required. 

Once updated, select "File", then "Save".

The ThreatLocker Deployment procedure is now ready for use.

Deploying to your Computers

1. Select the ThreatLocker Deployment procedure.
2. You can filter to deploy a single company using the "Machine Group" dropdown list.
3. Select all the computers you want to deploy to.
1. We advise a single computer first to ensure your naming is as expected in ThreatLocker.
2. If the naming is not correct, please contact your Solutions Engineer for deployment assistance, or reach out to a Cyber Hero - you may require a custom script.
4. Select Run Now.

After a couple of minutes, your computers will show in the ThreatLocker Portal.

Resolving a 1020 Error or a File was not uploaded message

Kaseya has created a tool that will update the XML file to make it importable. To download this tool and receive directions for using it to resolve these errors, please visit Kaseya's Help Desk article at: How to Import Agent Procedures after 9.5.7a – Kaseya.