Bitdefender Endpoint Security Tools (BEST), the GravityZone security agent, uses one installation package for any environment (physical or virtual). On Windows, GravityZone delivers the installation packages as executable kits, only in EXE format. This may be inconvenient if you want to deploy the agent via Windows Group Policy or any other third-party application that supports MSI packages.

The solution implies applying an MSI wrapper over Windows Downloader, the standard lite installer for BEST. This article provides the guidelines for downloading the installer and a few methods on how to deploy the BEST using the MSI package.

• Get Windows Downloader
• Deploy BEST via msiexec.exe command line
• Deploy BEST via Windows Group Policy (GPO)

Get Windows Downloader

Warning: Do not alter the Windows Downloader file name. Otherwise, the installation files will not download from the Bitdefender servers. Because Microsoft Edge may trim long file names such as the one of Windows Downloader, we recommend using another browser.

To download BEST installer:

1. Log in to GravityZone Control Center.
2. Navigate to Network > Packages.
3. Select the installation package you want to download.
   Important: This procedure currently does not support installation packages with proxy settings.
4. Click Download at the upper side of the table and select Windows Downloader.
   The installation package is saved to your default download location as an EXE file.

Deploy BEST via msiexec.exe command line

This method is suitable for command-line deployment tools that accept instructions with parameters. The method uses the msiexec command, having the MSI wrapper and the installer ID as parameters. The MSI wrapper is digitally signed by Bitdefender.

1. Download the MSI Wrapper.
2. Open Command Prompt as Administrator.
3. Run the following command to deploy BEST:
   msiexec /i full_path\BEST_downloaderWrapper.msi /qn GZ_PACKAGE_ID=string REBOOT_IF_NEEDED=parameter
   Where:
   • full_path is the actual path to the MSI Wrapper
   • string is the actual string between brackets, from the installation package name
   • parameter (optional) that reboots the machine when you deploy BEST over a competitor's product;
     1 = TRUE
     a notification prompts the user with a 10-minute time frame before restarting the machine.
   
   For example:
   Installation package name:
   setupdownloader_[aHR0cH-bGFuZz1lbi1VUw==].exe
   GZ_PACKAGE_ID value:
   aHR0cH-bGFuZz1lbi1VUw==

Note: The string in the example is only for illustration purposes only. The actual string is different and much longer.

Deploy BEST via Windows Group Policy (GPO)

Follow this method if all you need is to run the MSI file. In this case, you need to customize the wrapper with Orca.exe, to link it to the Windows Downloader. To avoid security warnings when running the resulted MSI file, you need to unblock it.

Warning: This method alters the digital signature of the MSI Wrapper.

1. Install Orca.exe
2. Customize the MSI Wrapper
3. Unblock MSI Wrapper to avoid security warnings
4. Deploy the MSI package

A. Install Orca.exe

Orca is a tool for creating and editing Windows Installer packages.

1. Download and run Windows SDK Components for Windows Installer Developers
2. Select the MSI Tools checkbox when asked to select the features to be installed.
   MSI Tools includes Orca.exe. For more information about Orca.exe, refer to this Microsoft topic.
   
3. Click Install.

B. Customize the MSI Wrapper

1. Download the MSI Wrapper.
2. Right-click the MSI template and select Edit with Orca.
3. In Orca, navigate to Tables > Property.
4. In the right panel, locate GZ_PACKAGE_ID under the Property column.
5. Under the Value column, click the corresponding cell to enter a new value.
6. Insert the string between brackets from the installation package EXE file.
   For example:
   Installation package name:
   setupdownloader_[aHR0cH-bGFuZz1lbi1VUw==].exe
   GZ_PACKAGE_ID value:
   aHR0cH-bGFuZz1lbi1VUw==

   Note: The string in the example is only for illustration purposes. The actual string is much longer.

7. Add the following parameter (including its value) to reboot the machine when you deploy BEST over a competitor's product:
   REBOOT_IF_NEEDED=1
   A notification prompts the user with a 10-minute time frame before restarting the machine.
8. Click OK to confirm.
9. Save changes made to the MSI Wrapper.

C. Unblock MSI Wrapper to avoid security warnings

Windows may prevent you from running files downloaded from the internet and raise a security warning. To avoid this situation with MSI Wrapper, follow these steps:

1. Right-click the MSI Wrapper template and select Properties.
2. In the General tab, select Unblock at the bottom of the window.
3. Click OK or Apply.
   

D. Deploy the MSI package

Use the modified MSI Wrapper to deploy the Bitdefender security agent through Windows Group Policy or any other third-party application that supports MSI packages.

Note: For silent installations, use the following parameters: /qn or /quiet.