How To Prepare a Golden Image with Cisco Secure Endpoint

Available Languages

Download Options

  • PDF     (43.1 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (82.8 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (68.3 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:March 29, 2022
Document ID:214462

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes the steps to prepare a 'Golden Image' for the deployment of Cisco Secure Endpoints on hosts. This will work with Virtual Machines (VMs) or Hardware 'Golden Image' use. A 'Golden Image' is used for the installation of the Cisco Secure Endpoint on multiple hosts from one image file.

    Prerequisites

    Requirements

    • Use of Windows OS command prompt
    • Knowledge of Virtual environments

    Note: On Secure Endpoint Windows Connector 6.3.1, a new install feature flag has been added. This will allow you to install the connector without the connector registering or causing issues with duplication in your deployment.

    Override Flag

    When you use the installer, the new flag to use for golden images is /goldenimage [1|0]

    • 0 - Default Value - this value will not trigger the golden image option, operates just as if the installer was run without the option at all. Does not skip Initial Connector registration and startup on install.
    C:\> CiscoInstaller_goldenimage.exe /R /S /goldenimage 0 [other options…]
    • 1 - Install as golden image. This would be the typical option used with the flag and is the only expected usage. Skips initial Connector registration and Startup on install.
    C:\> CiscoInstaller_goldenimage.exe /R /S /goldenimage 1 [other options…]

    Steps

    Note: It is best practice to install the connector last for preparation of the 'Golden Image'.

    1. Prepare the Windows image to your requirements; install all your required software configurations for the windows image except for the connector.
    2. Install the Cisco Secure Endpoint.
    3. Use the /goldenimage 1 flag to indicate to the installer that this is a golden image deployment.
      C:\> CiscoInstaller_goldenimage.exe /R /S /goldenimage 1
    4. Complete installation.
    5. Freeze your golden image.

    After the 'Golden Image' has had applications installed, the system prepped, and Secure Endpoint has been installed with the /goldenimage flag, the host is ready to be frozen and distributed. Once the cloned host boots up, Secure Endpoint will then start and register to the cloud. No further action is required with regards to configuraiton of the connector unless there are changes that you want to make to the policy or host.

    The flag prevents the connector from starting and registering on the base image. On the next start of the image, the connector will be in the functional state it was configured to be in by the policy assigned to it.

    Important: If the Golden Image gets registered to the AMP Cloud before you are able to freeze the VM, it is recommended to uninstall and re-install Secure Endpoint on the Golden Image VM and then freeze the VM again to prevent registration and duplicate connector issues. It is not suggested to modify any registry values for AMP as part of this uninstallation process.

    Update the Golden Image

    You have two options when you need to update a Golden Image in order to retain an unregistered connector.

    Recommended Process

    1. Uninstall the connector.
    2. Install the host updates / upgrades.
    3. Reinstall the connector after the golden image process using the golden image flags.
    4. The host should not start the connector if the process is followed.
    5. Freeze the image.
    6. Verify before spinning up clones that the Golden Image did not register to the Portal to prevent unwanted duplicate hosts.

    Alternate Process

    1. Ensure the host has no connectivity to the internet to prevent the connector registering.
    2. Stop the connector service.
    3. Install updates.
    4. Freeze the image once the updates have completed
    5. The connector needs to be prevented from registering in order to prevent duplicate hosts from occurring. When you remove connectivity, this prevents it from reaching out to register to the cloud. Also, the connector being stopped will keep it in that state until the next reboot which will allow the clones to register as unique hosts.
    6. Verify before spinning up clones that the Golden Image did not register to the Portal to prevent unwanted duplicate hosts.

    Related Information

    Revision History

    Revision Publish Date Comments
    3.0
    29-Mar-2022
    Added section relating to golden image updates.
    2.0
    03-Nov-2021
    Rebranding edits only.
    1.0
    22-Sep-2021
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Matthew Jacobs
      Cisco AMP Escalation Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products