Steps to Install Saner Agent Without Activation on Windows Templates

Overview

By default, the Saner CVEM Agent automatically activates immediately after installation.

 However, when creating Windows OS templates or golden images with the Saner Agent preinstalled, automatic activation is not desired. If the agent activates on the template, cloned machines may face activation and registration issues.

This knowledge base article explains how to install the Saner Agent without activation on a Windows template and outlines best practices to ensure seamless activation on cloned systems.

Use Case

• Creating Windows VM templates or golden images

• Avoiding premature agent activation on template machines

• Ensuring cloned machines activate correctly after deployment

Prerequisites

• Saner Agent package downloaded from Viser

• Administrator privileges on the Windows system

• Access to the activation configuration file (spsaneractivation.conf)

Steps to Install Saner Agent Without Activation (Windows)

Step 1: Extract the Agent Package

Extract the ZIP file downloaded from Viser. You will see a folder named in the following format:

• <AccountName> refers to the account used while downloading the agent

• <version> refers to the Saner Agent version

Step 2: Open an Elevated Command Prompt

Open Command Prompt as Administrator and navigate to the extracted agent folder:

Step 3: Install the Agent Without Activation

Run the following command from the same directory:

This command ensures:

• Silent installation (/S)

• Activation token is present

• Automatic activation is disabled during installation

Important Notes for Template Creation

Do NOT Start the Agent Service on the Template

After installing the agent without activation, ensure that:

• The Saner Agent service is NOT started

• The service does not automatically start before shutting down the template

Starting the agent service on the template will trigger activation, which can cause issues when machines are cloned.

Verify Agent Service Status

Before shutting down the template, verify that the Saner Agent service is not running using the following command:

Ensure the service state is STOPPED before proceeding.

Summary of the Issue

An issue was observed where cloned machines were not activating correctly. This occurred because the Saner Agent service was started on the template machine before shutdown, causing premature activation.

Resolution Implemented

• Installed the Saner Agent without activation on the template

• Ensured the agent service was not started on the template

• Shut down the template machine

• Cloned a new machine from the template

• On first boot of the cloned machine:

  • Agent activated automatically

  • Hostname update was detected

  • System reboot completed successfully

This confirmed the expected and correct behavior.

Best Practices

• Always install the agent with /SANER_ACTIVATE_OFF=TRUE on templates

• Never start the Saner Agent service on the template

• Validate service status before shutting down the template

• Allow activation only on cloned or deployed machines

Conclusion

Following the above steps ensures reliable and consistent Saner Agent activation when deploying systems from Windows templates, preventing activation conflicts and deployment issues.

For any questions or assistance, please reach out to SecPod Support.