Deploy Device Protection with ManageEngine

Use ManageEngine Endpoint Central to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

Installation

1. 1

   What you'll need

   Before starting, make sure you have the following from the Aikido Device Protection dashboard:

   • Your PowerShell install command (copied from the user group selector on the dashboard, includes token + installer download)

   If you're missing it, go back to the Aikido Device Protection dashboard, click Connect Device.

2. 2

   Run the install command on managed devices

   1. In Endpoint Central, go to Configurations → Add Configurations → Windows → Scripts → Custom Script.
   2. Give the script a name (e.g. "Aikido Device Protection install").
   3. Set Run as to System User so the installer has the privileges to write to Program Files and register the service.
   4. Set the execution frequency to Once so the script runs a single time on each target device.
   5. Paste the PowerShell install command copied from the Aikido Device Protection dashboard into the script body.
   6. Click Save and Publish, then assign the configuration to the target devices or device groups.

   The PowerShell command bundles your Device Protection token, downloads the latest installer, and installs silently. There is no extra MSI to upload.

3. 3

   Apply the lockdown policy

   Block uninstallation of the Aikido Device Protection application.

   Block uninstallation via AppLocker

   1. Create a new Custom Script configuration using the same steps above.
   2. Give it a name (e.g. "Aikido - AppLocker uninstall block").
   3. Paste the following PowerShell script into the script body:

   $tmp = "$env:TEMP\aikido-applocker.xml"
   Invoke-WebRequest -Uri "https://raw.githubusercontent.com/AikidoSec/safechain-internals/refs/heads/main/docs/aikido-applocker-deny-mdm.xml" -OutFile $tmp
   Set-AppLockerPolicy -XmlPolicy $tmp -Merge
   Remove-Item $tmp -Force

   4. Click Save and Publish and assign it to the target devices or device groups.
4. 4

   Reboot devices after installation

   1. In Endpoint Central, go to Tools → Shutdown/Restart.
   2. Select the target Windows devices from the list.
   3. Choose Restart and click Proceed.

   The agent fully activates on the next boot.

Troubleshooting