Deploy the Imprivata Agent via Active Directory Group Policy

Prepare the Files

To install the Imprivata agent in bulk via an MSI push, you need the correct MSI files:

1. In the Imprivata Admin Console, go to the Computers menu > Deploy agents option and click Distribute the Agent...
2. Select the agent MSI file. A download link is displayed.
3. To prepare the files:
3. Copy the MSI file (ImprivataAgent.msi or ImprivataAgentx64.msi) into a shared folder to which all endpoint computers have access.
4. In the same folder create a batch file with the line:
5. regedit.exe /s \\<computer name>\<shared folder name>\ registry.reg
6. This procedure refers to its filename as registry.bat

Create a new REG file to point the Imprivata agent to the Imprivata appliance. In the same folder as the MSI file, create a new REG file with the lines:

• Windows Registry Editor Version 5.00
• [HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent]
• "IPTXPrimServer"="https://<Imprivata appliance fully-qualified domain name>/sso/servlet/messagerouter"

In addition to these lines, create additional lines to modify. This procedure refers to its filename as registry.reg

Create the Package

Now create the package and tell the endpoint computers where to find it. In Active Directory, create a new group policy:

1. Right-click the OU that contains the target endpoint computers, and select Properties > Group Policy > New.
2. Give the policy a descriptive name.
3. Select the new Group Policy and click Edit.
4. In the Group Policy window, under Computer Configuration, select Software Settings > Software installation.
5. In the right-hand pane, right-click in the empty space and select New Package. A dialog box opens.
6. Enter the UNC path to the shared folder that you created earlier.

7. CAUTION: Use the Uniform Naming Convention (UNC) path. Do not use mapped drives or client computers with different mappings will be unable to find the files.

7. Select Assign.
8. Click OK to save the changes and close the window.

Add the BAT Script

After you make the package, use registry.bat to tell the installed Imprivata agents the location of the Imprivata appliance:

1. In Active Directory, under Computer Configuration, select Windows settings > Scripts (StartUp/Shutdown)

2. On the right pane double-click on the Startup option. This opens a new Startup Properties dialog.

3. Click Add.

4. Enter the UNC path to registry.bat in the shared folder that you created earlier.

5. In Add Script, click OK. The script is displayed in the Scripts list in the Startup Properties dialog.

6. After adding registry.bat, click Apply.

7. Click OK to close the dialog.

Your push is now configured within Active Directory Group Policy. Each computer in the OU will receive the Imprivata agent the next time it restarts.

You can use Microsoft Active Directory’s Group Policy tools to modify the Imprivata agent registry values in bulk. You may need to modify the agent registry values to:

• Change the Imprivata agent type.
• Require an SSL certificate for e-prescribing controlled substances.
• Change the IP address or DNS name where the agent looks for the Imprivata appliance.

There are three steps:

1. Prepare the Files

2. Create the Package

3. Add the BAT Script

Requirements

• A shared folder to which all endpoint computers have access.

• All the computers must be in one Active Directory Organizational Unit (OU).

Prepare the Files

Create a registry.bat file a registry.reg file :

1. In the shared folder to which all endpoint computers have access, create a batch file with the line:

2. regedit.exe /s \\<computer name>\<shared folder name>\ registry.reg
3. This procedure refers to this file as registry.bat

Create a new REG file with any changes you need to make to the agents. In the same folder, create a new REG file with the lines:

• Windows Registry Editor Version 5.00
• 64—bit endpoint computers: [HKEY_LOCAL_MACHINE\SOFTWARE\SSOProvider\ISXAgent]
• "IPTXPrimServer"="https://<Imprivata appliance fully-qualified domain name>/sso/servlet/messagerouter"

To set the agent type, set the Type registry value with a Data Type of DWORD and a Value of 1 for single-user computers, 2 for shared kiosk workstations, and 3 for Citrix or Terminal Servers.

To require SSL, set the SSLValidation registry value with a Data Type of DWORD and a Value of 1.

This procedure refers to this file as registry.reg

Create the Package

Now create the package and tell the endpoint computers where to find it. In Active Directory, create a new group policy:

1. Right-click the OU that contains the target endpoint computers, and select Properties > Group Policy > New.

2. Give the policy a descriptive name.

3. Select the new Group Policy and click Edit.

4. In the Group Policy window, under Computer Configuration, select Software Settings > Software installation.

5. In the right-hand pane, right-click in the empty space and select New Package. A dialog box opens.

6. Enter the UNC path to the shared folder that you created earlier.

   CAUTION: Use the Uniform Naming Convention (UNC) path. Do not use mapped drives or client computers with different mappings will be unable to find the files.

7. Select Assign.

8. Click OK to save the changes and close the window.

Add the BAT Script

After you make the package, use registry.bat to tell the installed Imprivata agents the location of the Imprivata appliance:

1. In Active Directory, under Computer Configuration, select Windows settings > Scripts (StartUp/Shutdown)

2. On the right pane double-click on the Startup option. This opens a new Startup Properties dialog.

3. Click Add.

4. Enter the UNC path to registry.bat in the shared folder that you created earlier.

5. In Add Script, click OK. The script is displayed in the Scripts list in the Startup Properties dialog.

6. After adding registry.bat, click Apply.

7. Click OK to close the dialog.

Your push is now configured within Active Directory Group Policy. Each computer in the OU will receive the registry changes the next time it restarts.