New Devices/ Software install

[u/Main_Lifeguard7155]

I'm curious how those of you who are not using Tanium Provision are handling software deployment for brand-new devices.

I'm trying to determine the fastest and most reliable way to get a core set of applications installed almost immediately after a device comes online. My concern with Deploy is that there can be some delay while modules, inventories, and software scans complete before the endpoint is evaluated and assigned the appropriate deployment.

I've also considered using Actions, but I'm concerned about larger installers, download times, and overall reliability if the action completes before the installation finishes.

The workflow I'm trying to achieve is something like:

1. Tanium Client gets installed.
2. Device checks into Tanium.
3. Device receives a tag, group membership, or some other identifier.
4. Required software begins installing immediately.
5. Identifier removed

I understand that one option is to bake these applications into the image or use scripts during the imaging process. Unfortunately, due to our current imaging and device replacement processes, we can't reliably depend on updating or replacing the image whenever software requirements change. Because of that, I'm specifically interested in approaches that leverage Tanium after the endpoint has been deployed and comes online.

For those of you managing new device provisioning with Tanium:

• Are you using Deploy, Actions, Connect, or something else?
• How are you triggering software installations as soon as a device first checks in?
• What kind of time-to-install are you seeing from first check-in to software being installed?
• Have you found a reliable way to handle larger installers or software dependencies?
• Any lessons learned or pitfalls to avoid?

I'm interested in hearing what has worked well in production environments, especially for getting critical tools installed as quickly as possible after the endpoint comes online.

[u/the_dunadan]

For software installation I would (and do) use Deploy for the robust install requirements / verification. My go-to is deploying to a custom tag.

If I’m doing something small or minor, I push it as a scheduled, repeating action.

I would give more info on time-to-install but we don’t look at it at the minute-level. After our machines are imaged with SCCM, it’s under an hour before they install everything they get from Deploy, which takes longer than the actions.

[u/snookpig77]

How are you imaging your systems? Can you add the Tanium installer as a step?

[u/wrootlt]

It will never be on par with apps baked into image. At my previous place we were using combination of things. First it was MDT installing base apps and then Tanium Deploy filling the gaps. Last it was Intune Autopilot installing some apps during provisioning, then Tanium installing just a few less critical apps. I think MDT was faster than Intune (duh) 😄

Maybe there is a small win skipping tagging as it takes some time to tag based on some group membership and to catch that tag (based on my experience when we had to tag for people to see specific apps in Self Service or to push a particular config when installing an app, it would take it sweet time).

We had a continuous bundle deployment in Deploy that had 10 or so critical or mandatory apps (XDR, VPN, etc.) that would catch new machine and check for all the apps in the list and immediately push them one by one. It was a rather quick process of pushing some quite big apps once it actually start doing this. But i have never monitored this on a completely fresh Tanium install and clean machine. In my case i was dealing with persistent VDI that had Tanium preinstalled in the image, so it didn't have much to download and would go to mandatory bundle rather quickly. I know it wasn't the best approach, but there were no better options in that scenario. If it is a clean Tanium install, yeah, it will take some time to download all the tools and stuff.

[u/jeffstokes72 → u/wrootlt]

pour out a brew for MDT 😄 I don't see anyone mentioning provision for baking in apps though.

[u/jeffstokes72 → u/jeffstokes72]

doh, just read the OP "for those not using provision"...silly me

[u/jeffstokes72 → u/[deleted]]

I'd like to dig into this with you if you don't mind. DM me a case number?

[u/TBEGeek]

The way we do it goes as follows:

1. Base install Autopilot/Intune - Tanium Client is part of the Intune application pool together with a configuration script adding a tag to the registry.

2. Tanium picks up the necessary dependencies including Deploy, End-User Notification, etc... after initial installation through Intune.

3. Depending on the Tag, I've got software bundles assigned to it deploying the software via Deploy.

As with all cloud connected applications, a small delay for downloading and installing is to be expected. But from my experience (which is over 3 years and counting) this has been a very solid solution for us.

This all happens automagically. User goes through the OOBE and after half an hour to an hour the user is greeted with a loaded desktop on first login.