> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/install-nightfall-ai-agent-for-windows-os/nightfall-windows-agent-deployment-sccm.md). # Nightfall Windows Agent Deployment: SCCM ### 1. Prerequisites * **Client**: SCCM Current Branch; SCCM client installed and healthy on target devices; a reachable Distribution Point (DP). * **Operating System**: Windows 10(22H2 and above)/11 **x64** targets (ARM not supported). * **Package**: From the [Endpoint](https://app.nightfall.ai/endpoint) page → navigate to Download package button → * Download **`NightfallAgent.msi`** * Copy **API Key** and **Company ID** ### 2. Reminders * **The agent self-updates** (every few hours) — SCCM’s job is a one-time install; don’t manage the version in SCCM (hence the version-agnostic detection in §3). * **Claude Code** shows a one-time security-consent dialog the first time it loads managed hooks — communicate this to developers. (On some 2.1.x builds `/hooks` may show “0” even when hooks are active — verify via the Nightfall console or `claude --debug`, not that count.) * Always "**Run as Administrator**". * Deployment runs in **System context** (SCCM default). ### 3. Stage the Content Put the installers on a UNC share the **site server and DP can read**. ``` \\\NightfallDeploy\ ├── Agent\NightfallAgent.msi ├── ClaudeCode\ (payloads\ + scripts\windows\ from the Claude Code package) ├── Cursor\ (payloads\ + scripts\windows\ from the Cursor package) └── VSCode\ (payloads\ + scripts\windows\ from the VS Code package) ``` > ⚠️ **Share permissions matter.** SCCM’s distribution service reads the source as the **site server’s computer account**, not your user. Grant **Read** to `Domain Computers` (or the site server’s machine account) on **both the share and NTFS** — otherwise Distribute Content fails with *“cannot access … Win32 error 5 (Access Denied).”* ### 4. Deploy the Nightfall Agent 1. Within SCCM, navigate to: Software Library → Application Management → Applications → Create Application → Manually specify → add a **Script Installer** deployment type. * **Content location:** `\\\NightfallDeploy\Agent` * **Installation program:** ``` msiexec /i "NightfallAgent.msi" API_KEY="" COMPANY_ID="" INSTALL_NF_DRIVER="1" /qn ``` * **Install behavior:** Install for system · Whether or not a user is logged on · Hidden * **Detection method — use a *****version-agnostic***** script (important):** On the Detection tab choose **Use a custom script → PowerShell** and paste: ```powershell if ((Test-Path 'HKLM:\SOFTWARE\NightfallAI\NightfallAgent') -and (Get-Service 'NightfallAgent' -ErrorAction SilentlyContinue)) { Write-Output 'Installed' } ``` {% hint style="info" %} **Do NOT use a fixed MSI product code for detection.** The agent auto-updates itself, and its MSI product code changes with every version — a product-code detection would break after the first auto-update and cause an endless reinstall/`1603` loop. The script above detects *any* installed version (SCCM installs once; the agent’s auto-updater keeps it current). {% endhint %} 2. Then **Distribute Content** → your DP 3. **Deploy** the app **Required** to your target device collection. ### 5. Deploy the Hooks (per IDE) * Create one **Script Installer** application per IDE (VS Code needs two — see below). * Common settings: Install for system · Whether or not a user is logged on · Hidden · **Required**. {% hint style="info" %} The install command stages the payload to the path the script expects, then runs the package’s `install.ps1`: {% endhint %} #### Claude Code * **Content location:** `\\\NightfallDeploy\ClaudeCode` * **Installation program:** ``` powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\claude-code' | Out-Null; Copy-Item -Force '.\payloads\nightfall-hooks.json' 'C:\Nightfall\Hooks\claude-code\'; & '.\scripts\windows\install.ps1'" ``` * **Detection — File System:** `C:\Program Files\ClaudeCode\managed-settings.d\nightfall-hooks.json` **exists** #### Cursor * **Content location:** `\\\NightfallDeploy\Cursor` * **Installation program:** ``` powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\cursor' | Out-Null; Copy-Item -Force '.\payloads\hooks.json' 'C:\Nightfall\Hooks\cursor\'; & '.\scripts\windows\install.ps1'" ``` * **Detection — custom PowerShell** (Cursor’s `hooks.json` is shared with other vendors, so *existence isn’t enough*): ```powershell $f = 'C:\ProgramData\Cursor\hooks.json' if ((Test-Path $f) -and (Select-String -Path $f -Pattern 'nightfall-hook-relay --source cursor' -Quiet)) { Write-Output 'Installed' } ``` #### VS Code + GitHub Copilot (two applications) **App 1 — hook file:** * **Content:** `\\\NightfallDeploy\VSCode` * **Install:** ``` powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "New-Item -ItemType Directory -Force 'C:\Nightfall\Hooks\vscode' | Out-Null; Copy-Item -Force '.\payloads\nightfall.json' 'C:\Nightfall\Hooks\vscode\'; & '.\scripts\windows\install.ps1'" ``` * **Detection — File System:** `C:\ProgramData\Copilot\hooks\nightfall.json` **exists** **App 2 — enterprise policy** (Copilot ignores hook files at paths not registered in policy): * **Content:** `\\\NightfallDeploy\VSCode` * **Install:** `powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\windows\install-policy.ps1` * **Detection — Registry:** `HKLM\SOFTWARE\Policies\Microsoft\VSCode` value `chat.hookFilesLocations` **exists** {% hint style="info" %} **Order:** deploy the **agent first** — it installs `nightfall-hook-relay` (which the hooks call) onto the system PATH. Hook files install without it, but only *fire* once the agent is present. {% endhint %} ### 6. Verify On a target device: 1. Run **Machine Policy Retrieval** 2. Navigate to **Application Deployment Evaluation** (Control Panel → Configuration Manager → Actions), then check: ```powershell Get-Service NightfallAgent # Running where.exe nightfall-hook-relay # relay on PATH Test-Path 'C:\Program Files\ClaudeCode\managed-settings.d\nightfall-hooks.json' Test-Path 'C:\ProgramData\Cursor\hooks.json' Test-Path 'C:\ProgramData\Copilot\hooks\nightfall.json' Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\VSCode' -Name 'chat.hookFilesLocations' -EA SilentlyContinue ``` 3. Confirm the device and per-IDE hook status appear healthy on the **Devices** page in the Nightfall console. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/install-nightfall-ai-agent-for-windows-os/nightfall-windows-agent-deployment-sccm.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.