Deploy Device Protection with Primo

Use Primo to deploy Aikido Device Protection across your managed Windows fleet with the required permissions in place.

Installation

1. 1

   What you'll need

   Before starting, make sure you have the following from the Aikido Device Protection dashboard:

   • Your PowerShell install command (copied from the user group selector on the dashboard, includes token + installer download)

   If you're missing it, go back to the Aikido Device Protection dashboard, click Connect Device.

2. 2

   Run the install command on managed devices

   Primo runs PowerShell scripts on Windows hosts through the Controls library. Upload the dashboard command as a .ps1 script, then run it against your target devices.

   1. In the Primo admin console, go to MDM → Controls → Scripts.
   2. Copy the PowerShell install command from the Aikido Device Protection dashboard. Save it as a .ps1 file (e.g. aikido-install.ps1), then click Add script, upload the file, and give it a name (e.g. "Aikido Device Protection install").
   3. Assign the script to the team or device group that should receive Aikido Device Protection.
   4. Go to Hosts, filter to your target Windows devices, select them, open the Actions menu, and choose Run script. Select the Aikido install script.
   5. Wait for the run to finish. Open the script run results and confirm every targeted device reports success before continuing.
3. 3

   Apply the lockdown policy

   End users must not be able to stop the Aikido service or uninstall the Aikido Device Protection app.

   Block uninstallation of Aikido Device Protection

   Run a PowerShell script that downloads and applies the AppLocker policy.

   1. In the Primo admin console, go to MDM → Controls → Scripts.
   2. Click Add script, name it (e.g. "Aikido uninstall block"), and paste the following:

   $tmp = "$env:TEMP\aikido-applocker.xml"
   Invoke-WebRequest -Uri "https://raw.githubusercontent.com/AikidoSec/safechain-internals/refs/heads/main/docs/aikido-applocker-deny-mdm.xml" -OutFile $tmp
   Set-AppLockerPolicy -XmlPolicy $tmp -Merge
   Remove-Item $tmp -Force

   3. Apply it to your target Windows device group.
4. 4

   Reboot devices after installation

   Add a reboot step to the install script: open the Aikido install script in MDM → Controls → Scripts (or add a follow-up script) and append Restart-Computer -Force so the device reboots at the end of the run.

   The agent fully activates on the next boot.

Troubleshooting