Windows

If you want to deploy the EDR on a large scale, we recommend starting with a manual test installation on a few endpoints.

1

Download the installer

The executable is only available from Stoïk Protect: go to MDR > Settings, click Windows, then click Download the executable (Windows 8.1 and above).

The download menu lists three files. Choose the one that matches the machine and how you deploy:

• ARM (arm64): SentinelOneInstaller_windows_arm64_v<version>.exe

• AMD / Intel (x64), manual installation on each machine: SentinelInstaller_windows_64bit_v<version>.msi. We recommend the .msi for manual installations, as several customers had problems installing with the .exe.

• AMD / Intel (x64), MDM or GPO deployment: SentinelOneInstaller_windows_64bit_v<version>.exe

If you use an .exe, run it from a command prompt rather than by double-clicking it.

Come back here once it's downloaded to continue the installation.

Supported Windows versions

Standard installer (Windows 8.1 and above):

• Windows 8.1 / 10 / 11 / 11 23H2 / 11 24H2 64-bit

• Windows Server IoT 2019 / 2022 / 2025

• Windows Server / Server Core 2012 R2 / 2016 / 2019 / 2022 / 2025

Legacy installer (will soon be replaced by Legacy Plus): also available from MDR > Settings > Windows > Download the executable in Stoïk Protect

• Windows 8.1 / 10 32-bit

• Windows 7 SP1 / 8 32/64-bit

• POSReady 7

• Windows Server / Storage Server / Server Core 2012 (not R2) 32/64-bit

• Windows Server 2008 R2 SP1 32/64-bit

Legacy Plus installer: also available from MDR > Settings > Windows > Download the executable in Stoïk Protect

• Windows XP SP3 / Vista SP2 32/64-bit

• Windows XP SP2 64-bit (AMD64/EM64T)

• Windows Embedded POSReady 2009

• Server 2003 SP2 / 2003 R2 SP2 / 2008 SP2 (not R2) 32/64-bit

2

Find your customer ID

Go to MDR > Settings and copy your customer ID.

3

Install SentinelOne

SentinelOne replaces your current antivirus. Uninstall it completely before proceeding.

If the firewall is managed separately, keep it running. If it is part of the same solution, copy any custom rules to Windows Firewall first.

Manual

1. Launch the executable on the target machine.

2. Enter your customer ID in the Site Token or Group Token field.

3. Click Install.

MDM

Run the following command:

<file_name>.exe -t <customer_ID> -q

Replace <customer_ID> with your customer ID.

GPO

1. Place the executable in a network share accessible to all domain computers. Example: \\Server\Share\<SentinelOne file>.exe. Ensure the share has Read permissions for the relevant computer groups.

2. Create a deployment script named InstallSentinelOne.bat:

@echo off
# Check if the script is running as administrator
$adminCheck = [Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent() if (-not $adminCheck.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
# Rerun the script with elevated privileges
Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File "$PSCommandPath"" -Verb RunAs exit }
# Set the variables
$installerPath = "Installation path" $siteToken = "customer_ID" $arguments = "-t $siteToken -q"
# Run the installation silently
Start-Process -FilePath $installerPath -ArgumentList $arguments -Wait -NoNewWindow

Replace Installation path with the share path and customer_ID with your customer ID. Test the script manually on one machine before deploying.

1. Create a GPO:

   1. Open the Group Policy Management Console: Windows + R > gpmc.msc > Enter.

   2. Right-click the target container (domain or OU) and click Create a Group Policy Object in this domain and link it here. Name it (e.g. SentinelOne Deployment).

   3. Right-click the new GPO and select Edit.

   4. Go to Computer Configuration > Policies > Windows Settings > Scripts.

   5. Double-click Start, click Add, then Browse and select InstallSentinelOne.bat.

   6. Copy the script to \\<server_name>\SysVol\<domain_name>\Policies\<GPO_GUID>\Machine\Scripts\Startup.

2. Apply the GPO:

   • Run gpupdate /force on a domain controller.

   • Restart a target machine to trigger the script.

   • Verify that SentinelOne is installed and running on that machine.

   • If you encounter any issues, check C:\Windows\Debug\StartupLog.txt.

Network traffic

If outbound traffic is blocked, see Network requirements for the addresses to allow.