> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/windows/deploy-aikido-endpoint-with-absolute.md).

# Deploy Device Protection with Absolute

Use Absolute to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

{% hint style="info" %}
All devices must have the Absolute agent installed and reporting to the Absolute console before you begin.
{% endhint %}

## Installation

{% stepper %}
{% step %}
**What you'll need**

Before starting, make sure you have the following from the Aikido Device Protection dashboard:

* Your **PowerShell install command** (copied from the user group selector on the dashboard)

If you're missing it, go back to the [Aikido Device Protection dashboard](https://app.aikido.dev/endpoint-protection/devices), click **Connect Device**.
{% endstep %}

{% step %}
**Run the install command on managed devices**

Push the PowerShell command from the Aikido dashboard to your Windows fleet using Absolute's Device Reach feature.

1. In the Absolute console, go to **Device Reach** in the left navigation.
2. Select **Custom Scripts**, then click **Create Script**.
3. Set the platform to **Windows** and the script type to **PowerShell**.
4. Paste the install command copied from the Aikido Device Protection dashboard into the script editor.
5. Set the timeout to at least **30 minutes** to allow for the installer download.
6. Assign the script to the target device group and click **Run**.

{% hint style="info" %}
After the script runs, check the Device Reach results panel to confirm successful execution on each device.
{% endhint %}
{% endstep %}

{% step %}
**Apply the lockdown policy**

Use Absolute's capabilities to ensure Aikido Device Protection stays installed and to harden the service against tampering.

**Block uninstallation of the Aikido Device Protection app**

Use Absolute's Device Reach to deliver an AppLocker policy that prevents users from running the Aikido uninstaller.

1. In the Absolute console, go to **Device Reach** in the left navigation.
2. Select **Custom Scripts**, then click **Create Script**.
3. Set the platform to **Windows** and the script type to **PowerShell**.
4. Paste the following PowerShell script into the script body:

```powershell
$tmp = "$env:TEMP\aikido-applocker.xml"
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/AikidoSec/safechain-internals/refs/heads/main/docs/aikido-applocker-deny-mdm.xml" -OutFile $tmp
Set-AppLockerPolicy -XmlPolicy $tmp -Merge
Remove-Item $tmp -Force
```

5. Assign the script to the target device group and click **Run**.

**Prevent removal via Application Persistence**

Use Absolute's Application Persistence feature to detect and heal removal of the Aikido Device Protection application.

1. In the Absolute console, go to **Resilience** in the left navigation.
2. Select **Application Persistence**, then click **Add application**.
3. Search for or enter the Aikido Device Protection application name.
4. Configure the persistence action (reinstall or alert) and assign it to the target device group.
5. Save the configuration.
   {% endstep %}

{% step %}
**Reboot devices after installation**

1. In the Absolute console, go to **Devices** and select the target Windows devices.
2. Use **Device Reach** to run a PowerShell reboot command:

```powershell
Restart-Computer -Force
```

The agent fully activates on the next boot.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Problem                                                      | Fix                                                                                                                                                                             |
| ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Device doesn't appear in the dashboard after the script runs | Reboot the device; the agent fully registers on the next boot                                                                                                                   |
| Script exits with an error in the MDM console                | Run the script manually as SYSTEM on a test host to see the full error; confirm the device has internet access to download the installer                                        |
| Agent service is not running                                 | Reboot the device; if the service is still absent, re-run the install script                                                                                                    |
| Script is blocked by execution policy                        | Scripts run via MDM execute as SYSTEM and bypass user-level execution policy restrictions; confirm the MDM is not applying an additional policy that restricts script execution |
| Device shows as inactive after installation                  | The agent needs a reboot to fully activate; check back after rebooting                                                                                                          |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/aikido-device-protection/deploying-aikido-endpoint/device-protection-mdm-guides/windows/deploy-aikido-endpoint-with-absolute.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.