Skip to content

Deployment with baramundi

This guide covers deploying the SenseOn Universal Sensor to Windows devices using baramundi Management Suite (bMS).

The recommended approach is to wrap the SenseOn install command in a PowerShell step inside a baramundi software package. The package always installs the latest published version of the Universal Sensor at run time, so no MSI needs to be staged on a depot or refreshed when a new sensor version is released.

Step 1: Copy your install command

  1. Log in to SenseOn.
  2. Navigate to Settings > Universal Sensor.
  3. Copy the Windows install command. It has the structure:
$env:SENSEON_INSTALLER_KEY="<your-installer-key>"; iwr -useb https://<your-tenant>.senseon.io/install.ps1 | iex

Step 2: Create the install script

Save the command as SenseOn-Install.ps1 on the machine where you run the baramundi Deployment Studio (bDS):

$ErrorActionPreference = "Stop"
$env:SENSEON_INSTALLER_KEY = "<your-installer-key>"
Invoke-WebRequest -UseBasicParsing -Uri "https://<your-tenant>.senseon.io/install.ps1" | Invoke-Expression

Substitute your tenant hostname and installer key from Step 1.

Step 3: Create the baramundi Software Package

  1. Open the baramundi Deployment Studio (bDS).
  2. Create a new package and name it SenseOn Universal Sensor.
  3. Add a PowerShell action (or a Run command action that invokes powershell.exe).

  4. Configure the action to run:

    powershell.exe -ExecutionPolicy Bypass -File SenseOn-Install.ps1

  5. Add SenseOn-Install.ps1 to the package's source files so it is delivered to the endpoint alongside the action.

  6. Set the action to run as Local System so the install has the privileges it needs.
  7. Save the package and publish it to your baramundi depot.

💡 Detection rule: Configure the package's "Installed" detection rule to check for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\senseon-bootstrapper, which exists once the SenseOn bootstrapper service is installed. This allows baramundi to recognise that an endpoint already has SenseOn installed and avoid re-running the install, which can fail rather than complete as a no-op on a host that already has the agent.

The bootstrapper is what this package installs, and it then downloads and installs the Universal Sensor itself. Detecting the bootstrapper rather than a sensor file keeps baramundi's responsibility scoped to what it deploys: if the bootstrapper installs but the sensor does not appear, the cause is usually a local antivirus, DNS, or TLS interception issue that re-running the install cannot resolve. Those cases show up as the device failing to check in to SenseOn (see Step 5).

Step 4: Create the baramundi Job

  1. In the baramundi Management Center, open Jobs and create a new job.
  2. Give the job a name such as Install SenseOn Universal Sensor.
  3. Add the SenseOn Universal Sensor package as a job step with the Install action.
  4. Under Targets, add the devices or device groups you want to deploy to (typically an OU, a baramundi group, or a dynamic group based on attributes).
  5. Set the Schedule to run on next check-in (or as appropriate for your environment).
  6. Save and enable the job.

Step 5: Verify

baramundi will run the job on each in-scope endpoint at its next check-in. Once the job completes successfully:

  1. Log in to SenseOn.
  2. Navigate to Assets > Devices.
  3. Confirm the host appears with its expected hostname and a recent Last Seen timestamp.

The job log in the baramundi Management Center reports the per-device status of the deployment, including the exit code of the PowerShell action.

For diagnostics if a host does not appear in SenseOn, see Troubleshooting.

❓ Need help: If the installation has not been successful please confirm that TLS interception is not taking place. If it is, you will need to allow list *.snson.net. Then contact our support team for additional help.