SASE deployment using a domain controller-Secure Access Service Edge(SASE)-阿里云帮助中心

This document explains how to deploy and uninstall the SASE security client in bulk by using a domain controller. Using group policy for automated installation improves endpoint security management. This method also provides a unified uninstallation solution for centralized management in large-scale enterprise environments.

Background

As enterprises embrace digital transformation and remote work becomes common, endpoint security has become a core component of IT management. The SASE (secure access service edge) architecture combines wide area network capabilities with network security services, such as zero trust, firewall, and data loss prevention. SASE is widely used for interconnecting branch offices, enabling secure remote access, and protecting cloud resources. For enterprises with hundreds or thousands of endpoints, manually installing or uninstalling a security client is inefficient and error-prone, making it difficult to enforce a unified security policy.

Using a domain controller with a group policy object (GPO) to deploy and uninstall the SASE App in bulk is an efficient, controllable, and centralized management solution. This method is ideal for medium-to-large organizations to automate software distribution and removal on domain-joined Windows endpoints, such as during employee onboarding, security compliance remediation, or when decommissioning the SASE service. This approach significantly reduces operational costs and ensures the consistency and timeliness of the security agent on all devices. This enhances the overall security posture. It also supports silent installation, version upgrades, and policy pre-configuration, making it a key method for standardized endpoint security management.

Prerequisites

Ensure your domain controller (DC) is running and all target endpoints are joined to the domain.

Procedure

Step 1: Configure a shared folder

Store the deployment and uninstallation scripts and the software installation package in a shared folder on the domain controller. Configure the appropriate read and execute permissions to ensure that target users or computers can access and run the files.

In Windows, create a folder, for example, C:\software.
Right-click the folder and select Properties.
On the Sharing tab, click Share.
In the Network access dialog box, select the users you want to share with, click Share, and then click Done.

Step 2: Download the SASE client

Download the SASE client to your domain controller to automatically install it on domain-joined hosts.

Log on to the Workspace Security console.
In the left-side navigation pane, click Settings.
On the Download Client tab, download the SASE client installation package (.exe) that corresponds to your Windows version.
Save the downloaded installation package to the C:\software folder.

Important

The downloaded SASE client filename contains a corporate identifier. Do not modify the filename.

Note that the default browser on HarmonyOS automatically replaces square brackets "[ ]" in the filename with underscores "_" during the download. For example, if the original package name is sase-4.x.x-x86[xxxx].exe, it may be changed to sase-4.x.x-x86_xxxx_.exe after download.

If you use the default browser on HarmonyOS to download the SASE client, you must manually change the underscores (_) in the filename back to the original square brackets ([ ]) before installation to ensure the filename matches the original and prevent potential issues.

Step 3: Create batch scripts

Create batch scripts (.bat files) for installation and uninstallation and save them to the shared folder. You can use these scripts with group policy to deploy and uninstall the SASE App in bulk on domain-joined hosts.

In the software folder, create two text documents: install.txt and uninstall.txt.

Add the following content to the scripts.

Install

Important

You must modify the path to the SASE installation package.

@echo off
setlocal
:: Before you distribute the script, you must modify the installation package path in the INSTALLER variable.
:: ================== Configuration Section ==================
set "WIN_32=HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AliSASE"
set "WIN_64=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AliSASE"
:: Path to the SASE installation package
set "INSTALLER=C:\software\sase-*****.exe"
set "SILENT_ARGS=/S /silent  /norestart /NoStart"
:: ============================================

echo Checking if the software is already installed...

:: Initialize flag variable: 0 indicates not installed, 1 indicates installed
set "installed=0"

:: Check the 64-bit registry
reg query "%WIN_64%" /reg:64 >nul 2>&1
if %errorlevel% == 0 (
    echo SASE is already installed.
    set "installed=1"
)

:: Check the 32-bit registry
reg query "%WIN_32%" /reg:32 >nul 2>&1
if %errorlevel% == 0 (
    echo SASE is already installed.
    set "installed=1"
)

:: Determine if the software is installed (OR condition)
if %installed% == 1 (
    echo.
    echo Detected that SASE is already installed, skipping installation.
    echo.
    timeout /t 1 >nul
    exit /b 0
)

:: ================== Run Installation ==================
echo.
echo Software not detected, starting installation...
if not exist "%INSTALLER%" (
    echo Error: Installation package not found!
    echo Path: %INSTALLER%
    pause
    exit /b 1
)

echo Running the installer...
start "" "%INSTALLER%" %SILENT_ARGS%

:: Optional: Wait for the installation to complete
timeout /t 60 >nul

echo Installation complete.
exit /b 0

Uninstall

Important

You must modify the version number of the installed SASE App.

@echo off
setlocal
:: This script must be run as an administrator.
:: ================== Configuration Section ==================
set "x86=C:\Program Files (x86)\Aliyun\SASE\4.x.x(SASE App version number)\uninst.exe"
set "64=C:\Program Files\Aliyun\SASE\4.x.x(SASE App version number)\uninst.exe"
set "uninstalled=/S /silent"
:: ============================================

echo Checking if the software is installed...

:: Check for the 64-bit uninstallation file
if exist "%64%" (
    echo Detected installed SASE, now uninstalling.
    start "" "%64%" %uninstalled%
    echo.
    timeout /t 10 >nul
    exit /b 0
)  


:: Check for the 32-bit uninstallation file
if exist "%x86%" (
    echo Detected installed SASE, now uninstalling.
    start "" "%x86%" %uninstalled%
    echo.
    timeout /t 10 >nul
    exit /b 0
)

After configuring the files, change their extensions to .bat, for example, install.bat and uninstall.bat.

Step 4: Create a GPO and configure the script

A group policy object (GPO) is used to centrally manage and configure computer and user settings in a Windows domain environment. Configuring a script in a GPO lets you automate the installation and uninstallation of the SASE App in a unified, secure, and auditable way.

Open the Group Policy Management Editor in Windows.
Right-click the domain name and select Create a GPO in this domain, and Link it here.
In the New GPO dialog box, enter a Name for the group policy and click OK.
Right-click the GPO that you created (for example, SASE Deployment Policy) and click Edit.
In the Group Policy Management Editor, navigate to Computer Configuration > Windows Settings > Scripts (Startup/Shutdown), and then double-click Startup.
In the Startup Properties dialog box, on the Scripts tab, configure the path to the bulk installation or uninstallation script.
1. Click Add. In the Add a Script dialog box, specify the Script Name for the bulk installation or uninstallation.
  
  The script name is the network path to the shared folder followed by the script filename, for example, \\IZ1O********\software\install.bat or \\IZ1O********\software\uninstall.bat. To find the path, right-click the shared folder (software) and view the Network Path on the Sharing tab.
2. Click OK. Then, in the Startup Properties dialog box, click Apply and then OK.

Step 5: Verify the deployment

Refresh the group policy: By default, group policy refreshes in a domain environment every 90 minutes. Run the following command to manually refresh the group policy on all hosts:
```
gpupdate /force
```
Restart the hosts: Restart all hosts in the domain. The script in the group policy runs immediately after the restart to install or uninstall the SASE App.

Step 6: Check events

The Windows Event Viewer is a built-in system management tool that collects, displays, and manages logs from the operating system, applications, and hardware devices. Use Event Viewer to check the execution status of the group policy.

In the Windows search box, enter Event Viewer or eventvwr.msc.
In the left-side navigation pane, select Windows Logs > System.
On the System page, view events from the GroupPolicy (Microsoft-Windows-GroupPolicy) source to check the execution status and any error messages that indicate a failure.