Skip to main content

Deploy .MSI Package via Silent Install

Synopsis

This step-by-step guide will describe how to edit the EvoCredentialProviderSetup.msi file using Microsoft Orca or 1 Windows Command Line/PowerShell. Use this guide to configure the msi for “Elevated Login” operating mode.

 

Method 1: Using Windows command line or PowerShell. 

This installation method is used to deploy the software silently using Windows Command Line or PowerShell. It also can be packaged in a .bat or .ps1 file and run it in any supported deployment tools. You can find template files in the attached. 

 

Requirements:
1.Download the latest Evo Credential Provider agent from HERE, and save it to a network share.

2. Have your installation information ready such as Access Token, Secret Key, URL, Directory etc. (you can get them from Evo portal)

3. The tools you intend to use must be run in Admin mode.

4. Msi file must be placed in the same folder you intend to run the command.

5. Change the properties to your correct information.

 

Command (1 line):

msiexec /i EvoCredentialProviderSetup.msi CREDENTIAL_MODE=100 ENVIRONMENTURL="https://yourENVname.evosecurity.com" DOMAIN="EvoDirectoryName" ACCESSTOKEN="yourAccessTokenID" APIKEY="yourSecretKey" SOLEPROVIDER="0" FAILSAFEUSER="" /qn

 

Properties explain:

1. CREDENTIAL_MODE=100
//Option 1 - Type in 10 to enable Elevated Login ONLY operating mode.
Option 2 - Type in 90 to enable Evo Secure Login (No Elevated Access) ONLY operating mode.
Option 3 - Type in 100 to enable both Evo Secure Login and Elevated Access operating mode.

2. ENVIRONMENTURL="https://yourENVname.evosecurity.com"

3. DOMAIN="EvoDirectoryName"

4. ACCESSTOKEN="yourAccessTokenID"

5. APIKEY="yourSecretKey"

6. SOLEPROVIDER="0"

//The SOLEPROVIDER property can be used to set Evo Secure Login as the only credential provider available on the computer where it is installed. By default, this feature is set to 0 which is disabled. You can edit the default SOLEPROVIDER property and set it to 1 to enable it.

7. FAILSAFEUSER=""

//The FAILSAFEUSER property can be used to set a user for which Evo Secure Login will not try attempt two factor authorization but will login the user with the credentials they provide. This is an optional setting available for only one user.

If the computer is attached to a domain, then this setting should be DOMAIN\USERNAME where DOMAIN is the Windows Active Directory domain and USERNAME is the username for the user on that domain.

However, if the computer is not attached to a domain, it is preferable that it would be WORKGROUP\USERNAME where WORKGROUP should be the literal string “WORKGROUP” (without quotes) and USERNAME will be the login name for that machine. 

8. MFATIMEOUT="0"

//MFATIMEOUT="0" (minutes): MFA Grace Period

9. NOELEVRDP="0"

//NOELEVRDP property can be used to enable or disable RDP support. By default, this feature is "0" which is enable. The feature is disable if the property is set to "1". 

 

 

Method 2: Using Orca to edit msi file.

Requirements

  • The latest EvoCredentialProviderSetup.msi downloaded and unpacked to your machine.
  • ECPS Customer Configuration Sheet(The JSON file that you made a copy of while creating an Access Token for this customer).
  • MS Orca installed to edit MSI file.

Steps

  1. Launch the Orca application.
    Silent_1.png
  2. Go to File, click on Open, and browse to the downloaded file EvoSecurityProviderSetup.msi, then select Open.
    Silent_2.png
  3. On the Tables menu, select Property.
    Silent_3.png
  4. Find the Property named CREDENTIAL_MODE and double-click the 90 under the Value column to edit it.  
  5. Option 1 - Type in 10 to enable Elevated Login ONLY operating mode.
    Silent_4.png
  6. Option 2 - Type in 90 to enable Evo Secure Login (No Elevated Access) ONLY operating mode.
    Silent_5.png
  7. Option 3 - Type in 100 to enable both Evo Secure Login and Elevated Access operating mode.
    Silent_6.png
  8. Now, right-click Property on the right-hand pane and then select Add Row.Silent.
    Silent_7.png
  9. In the Add Row dialog box, type ENVIRONMENTURL in the text box. DO NOT press the OK button yet.
    Silent_8.png
  10. Click on Value and type in your Evo Environment URL. For our demo we will use https://demo.evosecurity.com. Then click OK.
    Silent_9.png
  11. Once again, right-click Property on the right-hand pane and then select Add Row.
    Silent_10.png
  12. In the Add Row dialog box, type DOMAIN in the text box. DO NOT press the OK button yet.
    Silent_11.png
  13. Click on Value and type in the Evo Directory name for that customer. For our demo we will use evo.demo. Then click OK.
    Silent_12.png
  14. Once again, right-click Property on the right-hand pane and then select AddRow.
    Silent_13.png
  15. In the Add Row dialog box, type ACCESSTOKEN in the text box. DO NOT press the OK button yet.
    mceclip0.png
  16. Click on Value and type in your Evo Access Token. For our demo we will use AccessToken123. Then click OK.
    mceclip1.png
  17.  
  18. Once again, right-click Property on the right-hand pane and then select Add Row.
    Silent_13.png
  19. In the Add Row dialog box, type APIKEY in the text box. DO NOT press the OK button yet.
    Silent_14.png
  20. Click on Value and type in your Evo API Key(This is the SecretKey that you generated and saved a copy of in the Access=>Shared Key section). For our demo we will use abc123@@@. Then click OK.
    Silent_15.png
  21. Click on File, select Save As, type in a File name in the text box, and click Save to save your MSI file. In this demo, we will save the file as CustomerECPS.msi.
    Silent_18.png
  22. Exit Orca.

Conclusion

This concludes the steps to edit the MSI file for Elevated Login operating mode.  Please proceed to Deploy .MSI Package via GPO, to create a GPO for deployment.

Appendix

Below are additional MSI Properties that can be optionally set if desired.

FAILSAFEUSER Property

The FAILSAFEUSER property can be used to set a user for which Evo Secure Login will not try attempt two factor authorization but will login the user with the credentials they provide. This is an optional setting available for only one user. 

If the computer is attached to a domain, then this setting should be DOMAIN\USERNAME where DOMAIN is the Windows Active Directory domain and USERNAME is the username for the user on that domain. 

However, if the computer is not attached to a domain, it is preferable that it would be WORKGROUP\USERNAME where WORKGROUP should be the literal string “WORKGROUP” (without quotes) and USERNAME will be the login name for that machine. You can use Orca to add the FAILSAFEUSER property.

SOLEPROVIDER Property

The SOLEPROVIDER property can be used to set Evo Secure Login as the only credential provider available on the computer where it is installed. By default, this feature is set to 0 which is disabled. You can use Orca to edit the default SOLEPROVIDER property and set it to 1 to enable it.

Was this article helpful?