Deploy Device Protection with NinjaOne

Use NinjaOne to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

All devices must be enrolled in NinjaOne before you begin.

Installation

1

What you'll need

Before starting, make sure you have the following from the Aikido Device Protection dashboard:

• Your PowerShell install command (copied from the user group selector on the dashboard, includes token + installer download)

If you're missing it, go back to the Aikido Device Protection dashboard, click Connect Device.

2

Run the install command on managed devices

1. In the NinjaOne Admin Portal, go to Administration → Library → Automation.
2. Click Add automation → Add new script.
3. Configure the script:

   • Name: Aikido Device Protection installer
   • Language: PowerShell
   • Operating System: Windows
   • Architecture: All
   • Run as: System
4. Paste the PowerShell install command from the Aikido Device Protection dashboard into the editor and click Save.
5. In the left navigation, go to Devices, then filter by OS to show only Windows devices.
6. Select the target devices, then click Run in the toolbar, choose Script, and select Aikido Device Protection installer.
7. Confirm Run As is set to System, then click Run.

You can also schedule this script under Policies → Scheduled Automations to cover devices that come online later.

3

Apply the lockdown policy

Protect the Aikido service against tampering using NinjaOne's policy conditions. For uninstall prevention, use AppLocker outside NinjaOne.

1. In the NinjaOne Admin Portal, go to Administration → Policies.
2. Select (or create) the Windows policy assigned to your target devices.
3. Open the Conditions tab and click Add a condition.
4. Choose Windows Service (Windows) and configure:

   • Service: EndpointProtection
   • State: Stopped
5. Under the condition's Automation, add a script action that restarts EndpointProtection (for example, a PowerShell one-liner Start-Service EndpointProtection set to Run as: System).
6. Save the policy.

Block uninstallation of the Aikido Device Protection app

Create a NinjaOne automation script that applies the AppLocker policy via PowerShell:

1. In the NinjaOne Admin Portal, go to Administration → Library → Automation and click Add automation → Add new script.
2. Set Language to PowerShell, Operating System to Windows, and Run as to System.
3. Paste the following script and click Save:

$tmp = "$env:TEMP\aikido-applocker.xml"
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/AikidoSec/safechain-internals/refs/heads/main/docs/aikido-applocker-deny-mdm.xml" -OutFile $tmp
Set-AppLockerPolicy -XmlPolicy $tmp -Merge
Remove-Item $tmp -Force

1. Run the script against your target Windows devices from the Devices tab.

4

Reboot devices after installation

1. In the NinjaOne Admin Portal, open Devices and select your target Windows devices.
2. Click Run in the toolbar and choose Reboot. Select Later to schedule a restart, or Now for an immediate restart.
3. Pick a date, time, and time zone, then click Set.

The agent fully activates on the next boot.

Troubleshooting

Problem	Fix
Device doesn't appear in the dashboard after the script runs	Reboot the device; the agent fully registers on the next boot
Script exits with an error in the MDM console	Run the script manually as SYSTEM on a test host to see the full error; confirm the device has internet access to download the installer
Agent service is not running	Reboot the device; if the service is still absent, re-run the install script
Script is blocked by execution policy	Scripts run via MDM execute as SYSTEM and bypass user-level execution policy restrictions; confirm the MDM is not applying an additional policy that restricts script execution
Device shows as inactive after installation	The agent needs a reboot to fully activate; check back after rebooting