Deploy the Imprivata Agent via Active Directory Group Policy

You can use Microsoft Active Directory’s Group Policy tools to install the Imprivata agent in bulk on endpoint computers.

NOTE:

Installing the Imprivata agent does not require an Internet connection. However, the endpoint computer must have an Internet connection for the Chrome browser to acquire the Imprivata OneSign extension from the Chrome Web store. Without it, Enterprise Access Management with SSO will not work for Chrome profiled applications.

An Internet connection is also required when any updates or upgrades are applied to the extension through the Chrome Web store. To confirm the Imprivata OneSign extension was installed, use the "Customize and control Google Chrome" tab to the right of the search bar. Click More tools > Extensions to view the Imprivata OneSign extension.

  • A shared folder to which all endpoint computers have access.

  • All the computers must be in one Active Directory Organizational Unit (OU).

NOTE:

For standard msiexec options, you may want to run "msiexec /?" on the target operating system. Options vary by Windows Installer version. If that is not an option, see https://msdn.microsoft.com/en-us/library/cc185688(VS.85).aspx.

Prepare the Files

To install the Imprivata agent in bulk via an MSI push, you need the correct MSI files:

NOTE: When you only need to modify Imprivata agents in bulk, do not prepare an MSI file. Create the registry.bat file and edit the registry.reg file as needed.

  1. In the Imprivata Admin Console, go to the Computers menu > Deploy agents option and click Distribute the Agent...
  2. Select the agent MSI file. A download link is displayed.
  3. To prepare the files:
  4. Copy the MSI file (ImprivataAgent.msi or ImprivataAgentx64.msi) into a shared folder to which all endpoint computers have access.
  5. In the same folder create a batch file with the line:
  6. regedit.exe /s \\<computer name>\<shared folder name>\ registry.reg
  7. This procedure refers to its filename as registry.bat

Create a new REG file to point the Imprivata agent to the Imprivata appliance. In the same folder as the MSI file, create a new REG file with the lines:

  • Windows Registry Editor Version 5.00
  • [HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent]
  • "IPTXPrimServer"="https://<Imprivata appliance fully-qualified domain name>/sso/servlet/messagerouter"

In addition to these lines, create additional lines to modify. This procedure refers to its filename as registry.reg

Create the Package

Now create the package and tell the endpoint computers where to find it. In Active Directory, create a new group policy:

  1. Right-click the OU that contains the target endpoint computers, and select Properties > Group Policy > New.
  2. Give the policy a descriptive name.
  3. Select the new Group Policy and click Edit.
  4. In the Group Policy window, under Computer Configuration, select Software Settings > Software installation.
  5. In the right-hand pane, right-click in the empty space and select New Package. A dialog box opens.
  6. Enter the UNC path to the shared folder that you created earlier.

  7. CAUTION: Use the Uniform Naming Convention (UNC) path. Do not use mapped drives or client computers with different mappings will be unable to find the files.

  8. Select Assign.
  9. Click OK to save the changes and close the window.

Add the BAT Script

After you make the package, use registry.bat to tell the installed Imprivata agents the location of the Imprivata appliance:

  1. In Active Directory, under Computer Configuration, select Windows settings > Scripts (StartUp/Shutdown)

  2. On the right pane double-click on the Startup option. This opens a new Startup Properties dialog.

  3. Click Add.

  4. Enter the UNC path to registry.bat in the shared folder that you created earlier.

  5. In Add Script, click OK. The script is displayed in the Scripts list in the Startup Properties dialog.

  6. After adding registry.bat, click Apply.

  7. Click OK to close the dialog.

  • Your push is now configured within Active Directory Group Policy. Each computer in the OU will receive the Imprivata agent the next time it restarts.

    • You can use Microsoft Active Directory’s Group Policy tools to modify the Imprivata agent registry values in bulk. You may need to modify the agent registry values to:

    • Change the Imprivata agent type.
    • Require an SSL certificate for e-prescribing controlled substances.
    • Change the IP address or DNS name where the agent looks for the Imprivata appliance.

    There are three steps:

    1. Prepare the Files

    2. Create the Package

    3. Add the BAT Script

    Requirements

    • A shared folder to which all endpoint computers have access.

    • All the computers must be in one Active Directory Organizational Unit (OU).

    Prepare the Files

    Create a registry.bat file a registry.reg file :

    1. In the shared folder to which all endpoint computers have access, create a batch file with the line:

    2. regedit.exe /s \\<computer name>\<shared folder name>\ registry.reg
    3. This procedure refers to this file as registry.bat

    Create a new REG file with any changes you need to make to the agents. In the same folder, create a new REG file with the lines:

    • Windows Registry Editor Version 5.00
    • 64—bit endpoint computers: [HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent]
    • "IPTXPrimServer"="https://<Imprivata appliance fully-qualified domain name>/sso/servlet/messagerouter"

    To set the agent type, set the Type registry value with a Data Type of DWORD and a Value of 1 for single-user computers, 2 for shared kiosk workstations, and 3 for Citrix or Terminal Servers.

    IMPORTANT:

    If your enterprise is only licensed for Imprivata Enterprise Access Management with MFA (formerly Imprivata Confirm ID), only the Single-User Computer agent (Type 1) is supported.

    To require SSL, set the SSLValidation registry value with a Data Type of DWORD and a Value of 1.

    This procedure refers to this file as registry.reg

    Create the Package

    Now create the package and tell the endpoint computers where to find it. In Active Directory, create a new group policy:

    1. Right-click the OU that contains the target endpoint computers, and select Properties > Group Policy > New.

    2. Give the policy a descriptive name.

    3. Select the new Group Policy and click Edit.

    4. In the Group Policy window, under Computer Configuration, select Software Settings > Software installation.

    5. In the right-hand pane, right-click in the empty space and select New Package. A dialog box opens.

    6. Enter the UNC path to the shared folder that you created earlier.

      CAUTION: Use the Uniform Naming Convention (UNC) path. Do not use mapped drives or client computers with different mappings will be unable to find the files.

    7. Select Assign.

    8. Click OK to save the changes and close the window.

    Add the BAT Script

    After you make the package, use registry.bat to tell the installed Imprivata agents the location of the Imprivata appliance:

    1. In Active Directory, under Computer Configuration, select Windows settings > Scripts (StartUp/Shutdown)

    2. On the right pane double-click on the Startup option. This opens a new Startup Properties dialog.

    3. Click Add.

    4. Enter the UNC path to registry.bat in the shared folder that you created earlier.

    5. In Add Script, click OK. The script is displayed in the Scripts list in the Startup Properties dialog.

    6. After adding registry.bat, click Apply.

    7. Click OK to close the dialog.

  • Your push is now configured within Active Directory Group Policy. Each computer in the OU will receive the registry changes the next time it restarts.