KeepActive Agent 2.0 for Windows - Remote Installation Guide

KeepActive Agent 2.0 for Windows - Remote Installation Guide

KeepActive Agent 2.0 for Windows — Remote Installation and Deployment

This article describes the recommended remote installation and mass-deployment procedure for KeepActive Agent 2.0 on Windows workstations.

Use this guide when deploying KeepActive Agent 2.0 through:

  • Windows Group Policy computer startup scripts;
  • Kaspersky Security Center;
  • Microsoft Configuration Manager;
  • PDQ Deploy;
  • ManageEngine Endpoint Central;
  • NinjaOne;
  • Action1;
  • UEM / RMM platforms;
  • other centralized software-deployment tools that can run a CMD script or an explicit installation command.

1. Important Deployment Limitations

WARNING

Do not use direct MSI assignment through the standard Windows GPO path:

Computer Configuration -> Policies -> Software Settings -> Software Installation

For Group Policy deployment, use a computer startup script that calls msiexec.

IMPORTANT

MST transforms do not currently work for KeepActive Agent 2.0 deployment. Do not use an MST transform for this procedure.

Use one of these deployment patterns:

  1. A GPO computer startup .cmd script that calls msiexec with the required installation parameters.
  2. For Kaspersky Security Center, UEM, RMM, or similar systems, deploy a .cmd wrapper that calls msiexec.
  3. If the deployment platform can execute an explicit command reliably, the same msiexec command may be executed directly. Do not rely on native/direct MSI assignment as the primary deployment method unless it has been validated in that platform.
  4. A prepared MSI with the activation key already written into it may be used as the package source; it should still be launched through the CMD/msiexec deployment flow.

2. Before You Start

Prepare the following:

  • the KeepActive Agent 2.0 installation file in .msi format;
  • a current activation key from the personal account at https://my.kickidler.com;
  • the verified MSI preparation script, if the activation key must be written into the MSI file before deployment;
  • antivirus / EDR exclusions configured before installation for the Agent installation directory that will be used;
  • for GPO or other network-share deployment, a network location accessible to the target computer accounts through a UNC path;
  • local administrator rights or installation launch under the Local System / SYSTEM account.

IMPORTANT

Configure the required Agent installation-directory exclusion before deployment. See section 9 for the KeepActive Agent 2.0 installation paths and the hidden-installation path note.

Example UNC path for a network-share deployment:

\\SERVER\Software\KeepActive

For GPO, the MSI and CMD script must be reachable from the target computer in computer/SYSTEM context. If a deployment platform uploads or stages the package locally on the endpoint, a UNC path is not required.

Permission typeRecommended permission
Share permissionsDomain Computers -> Read
NTFS permissionsDomain Computers -> Read & Execute

NOTE

If a separate computer group is used for deployment, permissions can be granted to that group instead of Domain Computers.

3. Preparing the MSI with the Activation Key

The verified MSI preparation script can write the activation key into the installer in advance. This is useful for mass deployment because the activation key does not need to be passed in the installation command.

General procedure:

  1. Create a separate working folder on the administrator computer.
  2. Place the original KeepActive Agent 2.0 MSI file into the folder.
  3. Place the verified MSI preparation script into the same folder.
  4. Run the script according to its instructions.
  5. Specify the activation key from the personal account at my.kickidler.com.
  6. Obtain the prepared MSI.
  7. Place the prepared MSI together with the deployment CMD script in the package source or network share used for deployment.

Use the following filename format for the prepared MSI:

KeepActive_Agent_2.x.x.x.msi

IMPORTANT

Keep the unmodified original installer separately. Do not overwrite the source MSI when preparing a deployment copy.

WARNING

A prepared MSI contains the activation key. Store it only in an access-controlled deployment location and do not share it with third parties.

4. Installation Through a GPO Startup Script

For Group Policy deployment, use a computer startup CMD script.

Example script name:

install_keepactive_agent.cmd

4.1. Standard Installation with Prepared MSI

@echo off
set MSI_PATH=\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi
msiexec /i "%MSI_PATH%" /qn /norestart
exit /b %errorlevel%

4.2. Hidden Installation with Prepared MSI

@echo off
set MSI_PATH=\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi
msiexec /i "%MSI_PATH%" /qn /norestart HIDDEN_MODE=1
exit /b %errorlevel%

4.3. Installation Without a Prepared MSI

If the activation key is not already written into the MSI, pass it through ACTIVATION_KEY:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart ACTIVATION_KEY="YOUR_KEY"

IMPORTANT

For GPO, the installation entry point is the startup CMD script. If the MSI is prepared with the activation key, ACTIVATION_KEY is not required in the command. If it is not prepared, pass the key in the msiexec parameters.

5. Optional Installation Parameters

5.1. Installation Logging

For diagnostics, add verbose Windows Installer logging:

/L*V "C:\Windows\Temp\keepactive_agent_install.log"

Standard installation with logging:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart /L*V "C:\Windows\Temp\keepactive_agent_install.log"

Hidden installation with logging:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart HIDDEN_MODE=1 /L*V "C:\Windows\Temp\keepactive_agent_install.log"

NOTE

When installation runs under Local System / SYSTEM, C:\Windows\Temp\<\code> is a convenient location for the MSI log.

MSI installation log:

C:\Windows\Temp\keepactive_agent_install.log

5.2. Hidden Installation Mode

For hidden installation, add:

HIDDEN_MODE=1

Example:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart HIDDEN_MODE=1

5.3. Passing the Activation Key

If the MSI was not prepared in advance, pass the activation key through:

ACTIVATION_KEY="YOUR_KEY"

Example:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart ACTIVATION_KEY="YOUR_KEY"

WARNING

Do not send the activation key in plain text in support requests, screenshots, logs, or correspondence.

5.4. Combined Diagnostic Example

Hidden installation of an unprepared MSI with activation-key transfer and MSI logging:

msiexec /i "\\SERVER\Software\KeepActive\KeepActive_Agent_2.x.x.x.msi" /qn /norestart ACTIVATION_KEY="YOUR_KEY" HIDDEN_MODE=1 /L*V "C:\Windows\Temp\keepactive_agent_install.log"

IMPORTANT

For permanent mass deployment, prefer a prepared MSI so that the activation key is not exposed in the command line.

6. Configuring the GPO Startup Script

  1. Open Group Policy Management.
  2. Create a new Group Policy Object, for example Install KeepActive Agent 2.0.
  3. Link the GPO to the required organizational unit containing the target computers.
  4. Open the GPO for editing.
  5. Computer Configuration -> Policies -> Windows Settings -> Scripts (Startup/Shutdown) -> Startup.
  6. Open Startup and click Show Files.
  7. Copy install_keepactive_agent.cmd there.
  8. Click Add, select the CMD file, and save the changes.

It is also recommended to enable the network wait policy for startup-script deployments that read from a UNC share:

Computer Configuration -> Policies -> Administrative Templates -> System -> Logon -> Always wait for the network at computer startup and logon -> Enabled

On a test workstation, update Group Policy:

gpupdate /force

Restart the computer so the computer startup script runs.

IMPORTANT

A computer startup script runs during computer startup, not when a user signs in.

7. Installation Through Kaspersky Security Center, UEM, or RMM

For centralized deployment systems, use a CMD script as the verified deployment entry point. The CMD script calls msiexec with the required parameters.

General procedure:

  1. Create a deployment package or application task.
  2. Add the KeepActive Agent MSI and the deployment .cmd script to the package, or place them on a network share accessible to the target computers.
  3. Configure the task to run under Local System / SYSTEM or another context with local administrator rights.
  4. Configure the task to execute the .cmd script.
  5. Use a prepared MSI when possible. If the MSI is not prepared, include the activation key in the msiexec parameters inside the script.
  6. Add hidden-mode and logging parameters when required.
  7. Ensure antivirus / EDR exclusions are applied before the deployment task runs.
  8. Test the deployment on a small group of computers before applying it to the main device group.

Example package-local CMD script when the MSI is stored next to the script:

@echo off
set MSI_PATH=%~dp0KeepActive_Agent_2.x.x.x.msi
msiexec /i "%MSI_PATH%" /qn /norestart
exit /b %errorlevel%

Hidden-mode package-local example:

@echo off
set MSI_PATH=%~dp0KeepActive_Agent_2.x.x.x.msi
msiexec /i "%MSI_PATH%" /qn /norestart HIDDEN_MODE=1
exit /b %errorlevel%

NOTE

If the deployment platform reliably supports direct command execution, the equivalent msiexec line may be executed directly. Native/direct MSI package assignment without the CMD/msiexec flow is not the recommended verified method for this guide.

8. Basic Steps for Kaspersky Security Center

Kaspersky Security Center menu names vary by version. The deployment logic should remain the same:

  1. Create a remote application-installation task or equivalent deployment task.
  2. Create or select a package containing the KeepActive Agent MSI and the CMD deployment script.
  3. Configure the task to execute the CMD script rather than relying on native/direct MSI assignment.
  4. Run the task under the system account or with administrator rights.
  5. If a prepared MSI is used, the separate ACTIVATION_KEY parameter is not required.
  6. If an unprepared MSI is used, include ACTIVATION_KEY in the msiexec command inside the script.
  7. Apply the required antivirus / EDR exclusion before starting the deployment.
  8. Deploy first to a test group.
  9. Check the task result and the MSI log on the endpoint if logging was enabled.

9. Antivirus, EDR, and Security Exclusions

Configure the KeepActive Agent installation-directory exclusion before installation. Apply the exclusion through the organization’s approved endpoint-security policy so it reaches the target computers before the deployment task runs.

Installation typeDirectory to exclude
Standard installationC:\Program Files\TeleLinkSoftV2
Typical hidden installationC:\ProgramData\{9e7a7972-b921-4537-06fe-e4e40085e8ce}

HIDDEN INSTALLATION NOTE

Hidden installations may use another AltGuid / InstallDir. The actual installation directory used by the deployment package is authoritative. Configure the exclusion for that actual path before deployment.

WARNING

Keep the exclusion narrow. Do not exclude the entire C:\ drive, the entire C:\ProgramData directory, a user profile, all temporary directories, or unrelated parent directories.

10. Verifying Installation

After installation, verify the service set that matches the installation mode.

Standard installation:

Get-Service ngs_v2,ngs_updater_v2 -ErrorAction SilentlyContinue

Hidden installation:

Get-Service tls_v2,tls_updater_v2 -ErrorAction SilentlyContinue
Installation typeExpected service names
Standard installationngs_v2
ngs_updater_v2
Hidden installationtls_v2
tls_updater_v2

Also verify:

  • the computer or employee appears in the KeepActive web interface;
  • the workstation receives a license in the my.kickidler.com personal account;
  • there are no installation failures in the MSI log if logging was enabled;
  • there are no endpoint-security or firewall blocks affecting the Agent.

11. Agent Logs

Installation typeTypical log locations
Standard installationC:\Program Files\TeleLinkSoftV2\logs\agent.log
C:\Program Files\TeleLinkSoftV2\logs\updater.log (if present)
Typical hidden installationC:\ProgramData\{9e7a7972-b921-4537-06fe-e4e40085e8ce}\logs\agent.log
C:\ProgramData\{9e7a7972-b921-4537-06fe-e4e40085e8ce}\logs\updater.log (if present)

NOTE

The hidden installation directory can differ from the example above. If the example path does not exist, open the actual KeepActive Agent installation directory on that computer and use its logs folder.

View the last lines of the main log for a standard installation:

Get-Content 'C:\Program Files\TeleLinkSoftV2\logs\agent.log' -Tail 80

Typical hidden-installation example:

Get-Content 'C:\ProgramData\{9e7a7972-b921-4537-06fe-e4e40085e8ce}\logs\agent.log' -Tail 80

For support collection, archive the entire applicable logs directory for the affected period whenever practical rather than sending only one log file.

12. Typical Errors

12.1. Errors 1619 / 1620

Windows Installer cannot open the installation package or considers it invalid.

Check:

  • the UNC or package path;
  • package availability from the target computer/SYSTEM context;
  • share and NTFS permissions when a network share is used;
  • whether endpoint security blocked the installer;
  • whether the MSI file is complete and valid.

12.2. Error 1638

Windows Installer reports that another version of the product is already installed.

Check the installed KeepActive Agent version and determine whether the existing installation must be upgraded or removed according to the applicable deployment procedure.

12.3. Error 1720

Windows Installer reports that a script or custom action required by the installation failed.

Enable verbose MSI logging and inspect the log for the failing custom action. Do not assume a specific product root cause from error 1720 alone.

/L*V "C:\Windows\Temp\keepactive_agent_install.log"

12.4. Agent Does Not Appear in the Web Interface

Check:

  • activation-key correctness and license state;
  • the Windows service set for the installed mode;
  • agent.log and updater.log if the updater log exists;
  • the effective Agent server endpoint and network reachability;
  • outbound Agent-to-Server TCP connectivity on the configured port (default 16000);
  • antivirus / EDR / firewall blocks.

13. What to Send to Technical Support

If installation fails or the Agent does not appear in the web interface, provide:

  • KeepActive Agent MSI version;
  • installation method: GPO startup script, Kaspersky Security Center, RMM/UEM, manual test, or another deployment system;
  • the exact CMD script or msiexec command used, with the activation key masked;
  • MSI installation log if logging was enabled;
  • an archive of the applicable Agent logs directory for the affected period;
  • error screenshot or task error text if displayed;
  • installation mode: standard or hidden;
  • actual Agent installation directory when hidden mode or a custom InstallDir is used;
  • Windows version;
  • antivirus / EDR product and relevant policy details.

MSI log when logging is enabled:

C:\Windows\Temp\keepactive_agent_install.log

WARNING

Do not send the activation key in plain text in screenshots, logs, scripts, command lines, or correspondence. Mask it before sharing diagnostics.