I’m trying to automate Sysmon and Elastic Agent installation by executing a batch script with GPO but having some difficulties running it especially on Windows servers (another version of the script is tested and working on workstations, don’t ask me why >_>)

Result is :

Script is :

set _sysmonversion=13.20
set _depdir=\ShareGPO_deploySysmon%_sysmonversion%
set _depdire=\ShareGPO_deploy
set _setupfile=%_depdire%elastic-agent-8.13.4-windows-x86_64.msi
set _conf=sysmon_conf.xml
set _sysmon32=%_depdir%Sysmon.exe
set _sysmon64=%_depdir%Sysmon64.exe
set _sysmonconf=%_depdir%sysmon_conf.xml

echo Sysmon32bin :: %_sysmon32%
echo Sysmon64bin :: %_sysmon64%
echo SysmonConfDir :: %_sysmonconf%


reg Query "HKLMHardwareDescriptionSystemCentralProcessor" | find /i "x86" > NUL && set OS=32 || set OS=64
IF defined OS (
    if %OS%==32 GOTO check32
    if %OS%==64 GOTO check64
)

:check32
:: GET sysmon version installed
echo checking 32 bits version installed
FOR /F "tokens=2 delims==" %%I IN ('WMIC Path CIM_DataFile WHERE "name='C:\Windows\Sysmon.exe'" get version /format:list') DO SET "RESULT=%%I"
IF defined RESULT (
    IF %RESULT%==%_sysmonversion%.0.0 GOTO update_conf32    
)
IF NOT DEFINED RESULT GOTO install32
:check64
echo checking 64 bits version installed
FOR /F "tokens=2 delims==" %%I IN ('WMIC Path CIM_DataFile WHERE "name='C:\Windows\Sysmon64.exe'" get version /format:list') DO SET "RESULT=%%I"
IF defined RESULT (
    IF %RESULT%==%_sysmonversion%.0.0 GOTO update_conf64
)
IF NOT DEFINED RESULT GOTO install64

:: INSTALLATION
:install32
echo Install new 32 bits version
%_sysmon32% -accepteula -i %_sysmonconf%     
GOTO reboot_services

:install64
echo Install new 64 bits version
%_sysmon64% -accepteula -i %_sysmonconf%     
GOTO reboot_services

:update_conf32
echo Update 32 bits configuration
%_sysmon32% -c %_sysmonconf%     
GOTO install_elastic

:update_conf64
echo Update 64 bits configuration
%_sysmon64% -c %_sysmonconf%     
GOTO install_elastic

:reboot_services
net stop winlogbeat 2>nul >nul
net start winlogbeat 2>nul >nul

timeout /t 30 /nobreak > NUL
GOTO install_elastic

:install_elastic
echo checking if Elastic is already installed
if exist "C:Program FilesElasticAgent.installed" (

echo Elastic Agent is already installed, skipping ...
GOTO end_script

) ELSE (

msiexec.exe -i %_setupfile% INSTALLARGS="--url=https://collector-fleet.domain.com:10443 --enrollment-token=" /qn

GOTO end_script

)

:end_script
EXIT /b %errorlevel%

Do not hesitate to ask if you need more information

Thank you for your help !