How to Deploy the SentinelOne Agent via CLI (Windows & Linux with sentinelctl)

This guide walks through deploying and managing the SentinelOne Singularity endpoint agent from the command line on both Windows and Linux. The on-device CLI is the same tool on every platform — sentinelctl — which you use to register the agent to your console, check status and apply configuration. All commands below are taken from current SentinelOne / partner documentation; adjust file names to match the exact installer version you downloaded from your management console.

Before you start: get your site or group token

Every agent must register to a Site or Group in your Singularity management console using a token. In the console, open Sentinels → Packages (or the Site/Group settings), copy the relevant token, and download the matching installer for your operating system and architecture. The token is mandatory at install time — without it the agent installs but stays unmanaged.

Windows: silent agent installation

SentinelOne ships a single self-extracting installer, SentinelOneInstaller.exe (versions 22.2 and later). Run it from an elevated CMD or PowerShell prompt. The -t flag passes the token and -q runs it quietly:

# Quiet install, registering to a site/group token (run as Administrator)
SentinelOneInstaller.exe -t <SITE_OR_GROUP_TOKEN> -q

# Pass extra installer arguments if needed
SentinelOneInstaller.exe -a <installer_arguments> -t <SITE_OR_GROUP_TOKEN>

Note: with the -q quiet switch you must also supply -t and the token. The Windows /QUIET MSI switch is not effective on the EXE installer — use -q (or --qn) instead. If you deploy the dedicated MSI package via your RMM or Intune, the pattern is:

msiexec /i "SentinelInstaller_windows_64bit_v*.msi" SITE_TOKEN=<SITE_OR_GROUP_TOKEN> /q /NORESTART

Verify the Windows agent

The agent installs under C:\Program Files\SentinelOne\Sentinel Agent <version>\. From an elevated prompt in that folder, check status:

cd "C:\Program Files\SentinelOne\Sentinel Agent <version>"
sentinelctl status

The output shows the agent state and the Monitor Build id, confirming the agent is running and managed.

Linux: package install and registration

On Linux the agent runs entirely in user space — there is no kernel module to rebuild on kernel updates. Install the RPM or DEB package you downloaded for your distribution:

# RPM-based (RHEL, Rocky, Alma, Oracle, Amazon Linux)
sudo rpm -i <package_pathname>.rpm

# DEB-based (Ubuntu, Debian)
sudo dpkg -i <package_pathname>.deb

After the package is installed, the agent is not yet registered. The Linux sentinelctl binary lives at a fixed path, /opt/sentinelone/bin/sentinelctl, and must be run with sudo using its full path. Register it to your console with the site or group token, then start and verify:

# Register the agent to the management console
sudo /opt/sentinelone/bin/sentinelctl management token set <TOKEN_VALUE>

# Start the agent services
sudo /opt/sentinelone/bin/sentinelctl control start

# Confirm the agent is running
sudo /opt/sentinelone/bin/sentinelctl control status

# Confirm connectivity to the management console
sudo /opt/sentinelone/bin/sentinelctl management status

# Show the installed agent version
sudo /opt/sentinelone/bin/sentinelctl version

Pre-seeding configuration on Linux

For golden images, VDI or automated provisioning you can register the agent at install time by pointing to a config file. Note that the RPM path requires the --nodigest switch to avoid digest-verification errors:

# RPM with config file at install time
sudo S1_AGENT_INSTALL_CONFIG_PATH="/tmp/config.cfg" rpm -i --nodigest <package_pathname>.rpm

# DEB with config file at install time
sudo S1_AGENT_INSTALL_CONFIG_PATH="/tmp/config.cfg" dpkg -i <package_pathname>.deb

Day-2 management with sentinelctl

The same sentinelctl utility manages the running agent. Several operations require the Agent passphrase from the console (retrieve it under the endpoint's Actions → Show Passphrase). Common commands:

# Check agent status
sentinelctl status

# Disable anti-tampering protection (needed before some maintenance)
sentinelctl unprotect -k <S1_PASSPHRASE>

# Re-enable anti-tampering protection
sentinelctl protect

# Unload / load / reload agent monitor and agent components
sentinelctl unload -m -a
sentinelctl load -m -a
sentinelctl reload -m -a

# Run an on-demand scan of a folder
sentinelctl scan_folder -i <path>

# Check whether the agent has ever connected to management
sentinelctl ever_connected_to_management

# Apply a configuration parameter (passphrase required)
sentinelctl config <parameter> <value> -k "<S1_PASSPHRASE>"

On Windows run these from the agent folder; on Linux prefix them with sudo /opt/sentinelone/bin/. Commands are case-sensitive on all platforms.

Troubleshooting tips

• Agent shows unmanaged / never connected — confirm the token with management status (Linux) and re-run management token set; verify outbound HTTPS reachability to your console region.
• Maintenance blocked by anti-tampering — use sentinelctl unprotect -k <passphrase>, perform the change, then sentinelctl protect.
• Linux service not running — run control start then control status; check the agent logs under /opt/sentinelone/.

Need help with a fleet-wide rollout, policy tuning or a migration in Saudi Arabia? SKYLINE deploys, configures, supports and troubleshoots SentinelOne across Riyadh, Jeddah and Dammam. See our SentinelOne deployment and support service or call +966 50 993 9334.