Support for agent install --base-path when using defend / endpoint security is included

[jguay]

Current feature :

Currently per doc :

--base-path
Install Elastic Agent in a location other than the default. Specify the custom base path for the install.
The --base-path option is not currently supported with Elastic Defend.

Requested Feature :

Support for custom installation path when agent is using a policy that includes defend integration

Use case :

• User may be on virtualised environment and want to persist the agent folder by specifying a persistent location
• This feature is documented as not supported if the agent in question use a policy that include defend integration hence this causes a high number of offline then inactive agents by not being able to specify location of agent installation folder (agents then become inactive/hidden and need to be unenrolled)

[gabriellandau]

On Windows, this one's tricky because it violates certain trust assumptions made Endpoint and its [un]installers, making it harder to defend against some types attacks.

If pursued, perhaps we could limit this feature to Linux. It sounds like Linux is the intended use case anyway.

[user-987654321]

Hi. The use case is Windows

[gabriellandau]

The use case is Windows

Assuming this is a Citrix VDI issue, You should be able to achieve this by installing Agent to a VDI-persisted location while keeping Endpoint in its required location. Below is a powershell script that leverages a symbolic link (instead of --base-path) to redirect Agent's install to C:\ProgramData. You can change C:\ProgramData to another path as required in your environment. Agent will automatically install Defend at startup if required.

With this config, you can see Agent is running from C:\ProgramData but Endpoint is running from C:\Program Files.

Note that you may need the C:\Program Files\Elastic\Agent symbolic link to be present in your VDI base image (the mklink line below). If you're a customer with a support plan and want to follow up with more details, please feel free to reach out to your customer support representative.

# Remove any existing Agent
if (Test-Path "C:\Program Files\Elastic\Agent\elastic-agent.exe") {
    &"C:\Program Files\Elastic\Agent\elastic-agent.exe" uninstall -f
}
if (Test-Path "C:\ProgramData\Elastic") { cmd /c rd /s /q C:\ProgramData\Elastic }
if (Test-Path "C:\Program Files\Elastic") { cmd /c rd /s /q "C:\Program Files\Elastic" }

Write-Host "Redirecting Agent install to C:\ProgramData"
mkdir \ProgramData\Elastic\Agent
mkdir "\Program Files\Elastic"
cmd /c mklink /D "C:\Program Files\Elastic\Agent" C:\ProgramData\Elastic\Agent

$ProgressPreference = 'SilentlyContinue'
if (-not (Test-Path elastic-agent-8.15.1-windows-x86_64.zip))
{
    Invoke-WebRequest -Uri https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.15.1-windows-x86_64.zip -OutFile elastic-agent-8.15.1-windows-x86_64.zip
}
Expand-Archive .\elastic-agent-8.15.1-windows-x86_64.zip -DestinationPath .
pushd elastic-agent-8.15.1-windows-x86_64

# Hard-code "${install.in_default}" to "true" in endpoint-security.spec.yml
$SpecPath = (Get-ChildItem . -Recurse -Filter endpoint-security.spec.yml).FullName
$SpecContents = Get-Content -Path $SpecPath -Raw
$NewSpecContents = $SpecContents.Replace('${install.in_default}', "true")
if ($SpecContents -ne $NewSpecContents)
{
	Set-Content -Path $SpecPath -Value $NewSpecContents
	Write-Host "Installation Path Restrictions Removed: $SpecPath" -ForegroundColor Green
}

.\elastic-agent.exe install --url=YOUR_URL --enrollment-token=YOUR_TOKEN

popd