Nightfall Windows Agent Deployment: SCCM

A step-by-step guide to deploy the Nightfall endpoint agent and the AI-coding-assistant hooks (Claude Code, Cursor, VS Code + GitHub Copilot) to Windows devices using SCCM/MECM.

1. Prerequisites

• Client: SCCM Current Branch; SCCM client installed and healthy on target devices; a reachable Distribution Point (DP).

• Operating System: Windows 10(22H2 and above)/11 x64 targets (ARM not supported).

• Package: From the Endpoint page → navigate to Download package button →

  • Download NightfallAgent.msi

  • Copy API Key and Company ID

2. Reminders

• The agent self-updates (every few hours) — SCCM’s job is a one-time install; don’t manage the version in SCCM (hence the version-agnostic detection in §3).

• Claude Code shows a one-time security-consent dialog the first time it loads managed hooks — communicate this to developers. (On some 2.1.x builds /hooks may show “0” even when hooks are active — verify via the Nightfall console or claude --debug, not that count.)

• Always "Run as Administrator".

• Deployment runs in System context (SCCM default).

3. Stage the Content

Put the installers on a UNC share the site server and DP can read.

\\<fileserver>\NightfallDeploy\
├── Agent\NightfallAgent.msi
├── ClaudeCode\   (payloads\ + scripts\windows\ from the Claude Code package)
├── Cursor\       (payloads\ + scripts\windows\ from the Cursor package)
└── VSCode\       (payloads\ + scripts\windows\ from the VS Code package)

⚠️ Share permissions matter. SCCM’s distribution service reads the source as the site server’s computer account, not your user. Grant Read to Domain Computers (or the site server’s machine account) on both the share and NTFS — otherwise Distribute Content fails with “cannot access … Win32 error 5 (Access Denied).”

4. Deploy the Nightfall Agent

1. Within SCCM, navigate to: Software Library → Application Management → Applications → Create Application → Manually specify → add a Script Installer deployment type.

• Content location: \\<fileserver>\NightfallDeploy\Agent

• Installation program:

  msiexec /i "NightfallAgent.msi" API_KEY="<YOUR_API_KEY>" COMPANY_ID="<YOUR_COMPANY_ID>" INSTALL_NF_DRIVER="1" /qn

• Install behavior: Install for system · Whether or not a user is logged on · Hidden

• Detection method — use a version-agnostic script (important): On the Detection tab choose Use a custom script → PowerShell and paste:

  if ((Test-Path 'HKLM:\SOFTWARE\NightfallAI\NightfallAgent') -and (Get-Service 'NightfallAgent' -ErrorAction SilentlyContinue)) {
      Write-Output 'Installed'
  }

Do NOT use a fixed MSI product code for detection.

The agent auto-updates itself, and its MSI product code changes with every version — a product-code detection would break after the first auto-update and cause an endless reinstall/1603 loop. The script above detects any installed version (SCCM installs once; the agent’s auto-updater keeps it current).

1. Then Distribute Content → your DP

2. Deploy the app Required to your target device collection.

5. Deploy the Hooks (per IDE)

• Create one Script Installer application per IDE (VS Code needs two — see below).

  • Common settings: Install for system · Whether or not a user is logged on · Hidden · Required.

The install command stages the payload to the path the script expects, then runs the package’s install.ps1:

Claude Code

• Content location: \\<fileserver>\NightfallDeploy\ClaudeCode

• Installation program:

  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\claude-code' | Out-Null; Copy-Item -Force '.\payloads\nightfall-hooks.json' 'C:\Nightfall\Hooks\claude-code\'; & '.\scripts\windows\install.ps1'"

• Detection — File System: C:\Program Files\ClaudeCode\managed-settings.d\nightfall-hooks.json exists

Cursor

• Content location: \\<fileserver>\NightfallDeploy\Cursor

• Installation program:

  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\cursor' | Out-Null; Copy-Item -Force '.\payloads\hooks.json' 'C:\Nightfall\Hooks\cursor\'; & '.\scripts\windows\install.ps1'"

• Detection — custom PowerShell (Cursor’s hooks.json is shared with other vendors, so existence isn’t enough):

  $f = 'C:\ProgramData\Cursor\hooks.json'
  if ((Test-Path $f) -and (Select-String -Path $f -Pattern 'nightfall-hook-relay --source cursor' -Quiet)) { Write-Output 'Installed' }

VS Code + GitHub Copilot (two applications)

App 1 — hook file:

• Content: \\<fileserver>\NightfallDeploy\VSCode

• Install:

  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\vscode' | Out-Null; Copy-Item -Force '.\payloads\nightfall.json' 'C:\Nightfall\Hooks\vscode\'; & '.\scripts\windows\install.ps1'"

• Detection — File System: C:\ProgramData\Copilot\hooks\nightfall.json exists

App 2 — enterprise policy (Copilot ignores hook files at paths not registered in policy):

• Content: \\<fileserver>\NightfallDeploy\VSCode

• Install: powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\windows\install-policy.ps1

• Detection — Registry: HKLM\SOFTWARE\Policies\Microsoft\VSCode value chat.hookFilesLocations exists

Order: deploy the agent first — it installs nightfall-hook-relay (which the hooks call) onto the system PATH. Hook files install without it, but only fire once the agent is present.

6. Verify

On a target device:

1. Run Machine Policy Retrieval

2. Navigate to Application Deployment Evaluation (Control Panel → Configuration Manager → Actions), then check:

Get-Service NightfallAgent                                   # Running
where.exe nightfall-hook-relay                               # relay on PATH
Test-Path 'C:\Program Files\ClaudeCode\managed-settings.d\nightfall-hooks.json'
Test-Path 'C:\ProgramData\Cursor\hooks.json'
Test-Path 'C:\ProgramData\Copilot\hooks\nightfall.json'
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\VSCode' -Name 'chat.hookFilesLocations' -EA SilentlyContinue

1. Confirm the device and per-IDE hook status appear healthy on the Devices page in the Nightfall console.