Active Directory & Group Policy (GPO) Rollout
Edit ArticleMass deploy Sentinel across thousands of domain-joined Windows computers automatically.
Using Active Directory Group Policy (GPO) is the gold standard for deploying Sentinel to hundreds or thousands of corporate computers on an internal Windows domain without touching individual machines.
Create a Central Network Share (SYSVOL / NetLogon)
Create a read-only network share accessible by all domain computers (e.g. \\yourdomain.local\SYSVOL\SentinelDeploy\). Copy "sentinel-agent.msi" and "sentinel-agent.toml" into this share.
Open Group Policy Management Console (gpmc.msc)
On your Domain Controller, open "Group Policy Management". Right-click your target Organizational Unit (OU) (e.g., "Corporate Laptops") and select "Create a GPO in this domain, and Link it here...". Name it "Sentinel Agent Auto-Deploy".
Configure Software Installation Package
Edit the GPO and navigate to: Computer Configuration → Policies → Software Settings → Software installation. Right click → New → Package. Select the UNC network path "\\yourdomain.local\SYSVOL\SentinelDeploy\sentinel-agent.msi" and choose "Assigned".
Deploy Config File via Group Policy Preferences
Under Computer Configuration → Preferences → Windows Settings → Files, create a new File copy rule that copies "sentinel-agent.toml" from your share to "C:\Program Files\Sentinel\config\sentinel-agent.toml".
Trigger Domain Policy Update
Computers in the OU will automatically install Sentinel on their next reboot. To force an immediate update on a test machine, run: gpupdate /force
Always Use UNC Paths
Was this documentation page helpful?
Your technician feedback helps our team continuously improve Sentinel guides.