Install-EpsHybridWorker
Documentation out of date
The documentation below was written for a different copy of this script than the one published now. Read the script itself before you run it, or ask support@invardia.com.
- the .doc.json names no sha256 of the script it documents
- the .doc.json is for version 2.0.0, the published script is 2.0.107
The published script's own summary: Installs the Entra Policy Suite hybrid worker on a domain-joined Windows server (an Azure VM or an Azure Arc-enabled on-premises server) - run ON the worker, elevated (DESIGN §6; one worker per product, D5).
Purpose
Installs the worker that writes the tags of AD-synced users in on-premises AD and reads AD group membership for the rules. It talks to Entra Policy Suite only through its SQL database with the machine's managed identity, and writes AD as the gMSA you name. Nothing inbound, no password, no gallery module. From 2.0.102 the worker updates itself once a day to the version the install runs, only from Invardia's signed release, and switches back to the previous version when the new one fails its self-test.
When to run it
Once on the worker (an Azure VM or an Azure Arc-enabled server), after Initialize-EpsHybridWorkerAd.ps1 and Grant-EpsHybridWorkerAccess.ps1. Run it once again on a worker installed before 2.0.102, to add its daily update. Again with -Remove to take it away.
Who may run it
| Kind | Role | Scope | Why |
|---|---|---|---|
| other | local Administrator on the worker | the worker machine | copies the code, sets ACLs, user rights and a scheduled task |
What it changes
| Where | Action | What | Permission / role | Scope | Why | Undo |
|---|---|---|---|---|---|---|
| the worker | create | C:\EntraPolicySuite\versions\<version> (the worker code; the current and the previous version), the junction C:\EntraPolicySuite\app pointing at the current one, C:\EntraPolicySuite\worker.json (the database, the worker name, the gMSA - no secret), C:\EntraPolicySuite\logs | the worker machine | the worker runs from there; the daily update switches the junction | -Remove (deletes app and versions; the logs stay) | |
| the worker | update | the ACL of C:\EntraPolicySuite | SYSTEM + Administrators full control; the gMSA read + execute, modify on logs only | C:\EntraPolicySuite | only administrators may change the code the gMSA runs | delete the folder |
| the worker | grant | the gMSA | Log on as a batch job | the worker machine | the scheduled task runs as the gMSA | remove it from the local security policy |
| the worker | grant | the gMSA | member of the local group 'Hybrid agent extension applications' (Azure Arc only) | the worker machine | it reads the Arc agent's identity key to get the machine's token | -Remove |
| the worker | create | scheduled task 'EntraPolicySuite Hybrid Worker' (every 5 minutes, as the gMSA) | the worker machine | one worker cycle every 5 minutes | -Remove | |
| the worker | create | scheduled task 'EntraPolicySuite Hybrid Worker Update' (daily 05:30, as SYSTEM) | the worker machine | the worker follows the version the install runs: Invardia's signed release is checked (signature, sequence, SHA-256, size, version) before anything is switched; a failed self-test switches back | -Remove |
What it only reads
- the release folder it installs from
Parameters
| Parameter | Required | Default | What it does |
|---|---|---|---|
| -GmsaName | yes | DOMAIN\name$ of the gMSA the worker writes AD as | |
| -SqlServer | yes | <name>.database.windows.net of the Entra Policy Suite database | |
| -Database | no | eps | the database |
| -WorkerName | no | the computer name | the worker's name in the heartbeat |
| -AdServer | no | the domain locator | a domain controller to use |
| -ManagedIdentityClientId | no | the machine's identity | a user-assigned identity's client id (Azure VM) |
| -HostType | no | Auto | Auto | AzureVm | Arc |
| -Environment | no | the AD environment this worker serves (e.g. DMZ_Prod) when you have several AD forests or domains; empty = the only one | |
| -Remove | no | false | take the worker away |
Preview with -WhatIf
Every step it would take; nothing is copied, granted or registered.
Undo
-Remove: both tasks, the group membership and the code; then Initialize-EpsHybridWorkerAd.ps1 -Remove and Grant-EpsHybridWorkerAccess.ps1 -Remove.
Network
It connects to: <server>.database.windows.net (the worker, every cycle), the domain controllers (LDAP, the worker), https://invardia.com and the release download it names (the daily update, HTTPS outbound)
Download and run
Run these lines in PowerShell: the first downloads the script into the current folder, the second runs it.
Invoke-WebRequest https://invardia.com/support/eps/Install-EpsHybridWorker.ps1 -OutFile Install-EpsHybridWorker.ps1
.\Install-EpsHybridWorker.ps1 -GmsaName <GmsaName> -SqlServer <SqlServer>To check the download first, compare its SHA-256 with the published one:
SHA-256 774d7b427b26a4d0093ef917345642316baca4c1c19aa2a30f236051a39863a0
Checksums: SHA256SUMS.txt · Version 2.0.107 · Documentation for version 2.0.0
Before you run it, compare the file's SHA-256 with its line in SHA256SUMS.txt.
Every parameter: Get-Help .\Install-EpsHybridWorker.ps1 -Full · Source: Install-EpsHybridWorker.ps1
Every script, identity and permission for your security review: Entra Policy Suite