In this article

This articles outlines how to mass distribute the Windows Roaming Client via Active Directory (AD, also known as Entra ID). 

Deploying the Windows agent via AD is beneficial to set policies for different user groups, e.g. Executives/Employees or Faculty/Students. Easily integrate AD Organizational Units (OUs) with the DNSFilter Sync Tool to apply policies quickly, and add a blanket network policy by setting up DNS Forwarding on the domain controller. 

Active Directory deployment is done by creating a Group Policy Object (GPO). Using Microsoft Transform (MST) files, integrate any of the command-line options listed in our silent installation article with the installer. This means you can smoothly deploy the client with preset tags, show/hide the tray icon, and associate the client with a specific network location.

Once deployed, manage Roaming Client settings like tags, Site, Filtering Policies, and Block Pages. Assign by individual agent or as groups to ensure filtering policies are as specific as possible for your environment.

Deploy via Active Directory

The installation procedure for the Roaming Client is based on the standard method of using Group Policy. 

Step one: Download the agent Installer

1. From the DNSFilter dashboard, navigate to Deployments and select Roaming Clients
2. Tab to Install
3. Download the DNSFilter installer

Step two: Edit the MSI file in Orca

Download the Orca tool for free from the Windows SDK.

Before you begin: Any line labeled SETCMD in the MST file can be changed, but it may not be wise to do so in Orca because it is easier to customize via the DNSFilter dashboard.

We recommend making the MST file as widely applicable as possible and customize in the dashboard. Hardcoding too many values here will result in increasing the deployment complexity in AD, which should be avoided.

If possible, generate just one Orca transform file per location/network site registered with DNSFilter.

1. From Orca, open the MSI file (the Windows installer)
2. Navigate to Tables and select Custom Actions
   1. Update any command-line options listed in our silent installation article if applicable
      ✍️ We recommend using tags as a command-line flag that correspond to the user groups in AD, such as Sales or Engineering. This will result in a similar structure reflected in the DNSFilter dashboard as your AD environment. 
3. Select Transform
4. Select New Transform
5. Enter the Site Secret Key
   1. Navigate back to the DNSFilter dashboard's Roaming Clients install tab
   2. Select a Site to associate with the deployment
   3. Copy the Site Secret Key
   4. Navigate back to the Transform file
   5. Paste the Site Secret Key in the SETCMD NKEY line
      ✍️ edited fields turn green to note the change
6. Select Transform
7. Select Generate Transform
8. Save the file and exit Orca

Step three: Create a Network Share

This is necessary to distribute MSIs in Active Directory. If you already have this setup, skip this section.

1. From the Windows Server, open Server Manager
2. Navigate to File and Storage Servers
3. Select Shares
4. From the Tasks dropdown, select New Share
5. Click through Next until Specify Share Name
   ✍️ Note the Local Path. You'll navigate back here during step four. 
6. Name the Share
7. Select Next until the end

Step four: Move the MSI and MST Files to the Network Share

1. From Downloads, cut the MSI and MST files
2. Navigate to the Network Share's Local Path 
3. Paste the files

Step five: Create and the Group Policy

1. Navigate to Server Manager
2. Select Tools
3. Select Group Policy Management
4. Select computer's OU inside the headquarters
5. Right click and select Create new GPO
6. Name the new GPO

Step six: Edit the Group Policy

1. Navigate to Policies and select software settings
2. Select software installation
3. Right-click and select new package. It will prompt for the MSI file
4. Navigate to the network share and open the MSI file
5. Select advanced under deployment method
6. Select OK
7. Navigate to modifications
8. Select add
9. Add MST file

That's it! During the next policy refresh the Roaming Client will automatically complete a silent deployment across the OU along with the certificate file for HTTPS block pages. The client will register to DNSFilter and begin filtering and logging DNS query traffic in the DNS Query Log.