# Deploy Bitdefender on Windows Devices using Hexnode UEM

**Bitdefender Endpoint Security Tools (BEST)** is a comprehensive security agent that protects devices from malware, ransomware, and network attacks. This guide covers deploying the BEST agent on Windows devices using Hexnode UEM, allowing administrators to remotely install it without user intervention.
Prerequisites
-------------

- Administrator access to the Bitdefender GravityZone Control Centre.
- Target Windows devices must be enrolled in Hexnode UEM.

Step 1: Retrieve the Bitdefender GravityZone Package ID
-------------------------------------------------------

Before deploying Bitdefender via Hexnode UEM, retrieve the package ID associated with the Bitdefender installation package:

1. **Generate Package**: Log in to **BitDefender GravityZone Control Centre** portal and navigate to **Network > Packages > Installation Packages**. Click **Create** to configure your specific security modules.
2. **Save & Export**: After saving, select your package and click **Send Download Links**.
3. **Extract ID**: In the download window, locate the **Windows Downloader URL** and copy the alphanumeric string enclosed in square brackets. This value is the **GravityZone Package ID.**
    - Example URL: https://cloudap.gravityzone.bitdefender.com/Packages/BSTWIN/0/setupdownloader\_\[aHR0cHM6Ly9jbG91ZGFwLWVj==\].exe
    - Extracted ID: aHR0cHM6Ly9jbG91ZGFwLWVj==

[![GravityZone Package ID of Windows Downloader from BitDefender GravityZone portal.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/06/GravityZone-Package-ID.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/06/GravityZone-Package-ID.png "GravityZone Package ID ")

Step 2: Prepare the PowerShell Script
-------------------------------------

To deploy the BEST agent through Hexnode UEM, create a PowerShell script using the following code, and save it as a **.ps1** file on your device/upload it to the **Hexnode Script Repository**. Ensure you replace “**$GZ\_Package\_ID** ” with the **GravityZone Package ID** from Step 1.

Script to install Bitdefender on Windows

\# Bitdefender BEST Network Installer (Simple + Clear Messaging) $ErrorActionPreference = "Stop" $DownloadUrl = "https://download.bitdefender.com/SMB/Hydra/release/bst\_win/downloaderWrapper/BEST\_downloaderWrapper.msi" $MsiPath = Join-Path $env:TEMP "BEST\_downloaderWrapper.msi" try { Write-Host "Step 1: Downloading Bitdefender installer package..." Invoke-WebRequest -Uri $DownloadUrl -OutFile $MsiPath if (!(Test-Path $MsiPath)) { throw "Download failed: Installer file was not created." } Write-Host "Step 2: Installer downloaded successfully." Write-Host "Step 3: Launching Bitdefender network installation (this may take several minutes)..." $Process = Start-Process -FilePath "msiexec.exe" -ArgumentList @( "/i" "`"$MsiPath`"" "/qn" "GZ\_PACKAGE\_ID= $GZ\_Package\_ID" "REBOOT\_IF\_NEEDED=1" ) -Wait -PassThru switch ($Process.ExitCode) { 0 { Write-Host "Installer completed successfully. Bitdefender deployment has been initiated." } 3010 { Write-Host "Installer completed successfully. A system reboot is required to finalize setup." } default { Write-Host "Installer finished with exit code $($Process.ExitCode). The network deployment may not have started correctly." } } exit $Process.ExitCode } catch { Write-Host "Installation failed: $($\_.Exception.Message)" exit 1 } 

   1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

  \# Bitdefender BEST Network Installer (Simple + Clear Messaging) 

$ErrorActionPreference = "Stop"

$DownloadUrl = "https://download.bitdefender.com/SMB/Hydra/release/bst\_win/downloaderWrapper/BEST\_downloaderWrapper.msi"

$MsiPath = Join-Path $env:TEMP "BEST\_downloaderWrapper.msi"

try {

Write-Host "Step 1: Downloading Bitdefender installer package..."

Invoke-WebRequest -Uri $DownloadUrl -OutFile $MsiPath 

if (!(Test-Path $MsiPath)) {

throw "Download failed: Installer file was not created."

}

Write-Host "Step 2: Installer downloaded successfully."

Write-Host "Step 3: Launching Bitdefender network installation (this may take several minutes)..."

$Process = Start-Process -FilePath "msiexec.exe" -ArgumentList @(

"/i"

"`"$MsiPath`""

"/qn"

"GZ\_PACKAGE\_ID= $GZ\_Package\_ID"

"REBOOT\_IF\_NEEDED=1"

) -Wait -PassThru 

switch ($Process.ExitCode) {

0 {

Write-Host "Installer completed successfully. Bitdefender deployment has been initiated."

}

3010 {

Write-Host "Installer completed successfully. A system reboot is required to finalize setup."

}

default {

Write-Host "Installer finished with exit code $($Process.ExitCode). The network deployment may not have started correctly."

}

}

exit $Process.ExitCode

}

catch {

Write-Host "Installation failed: $($\_.Exception.Message)"

exit 1

} 

   

 

  

Step 3: Deploy via Hexnode UEM
------------------------------

1. Log in to your **Hexnode UEM** portal.
2. Navigate to **Manage > Devices** and select your target Windows endpoints.
3. Click **Actions > Deployments > [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/)**, select the PowerShell script, and execute it.

Hexnode UEM executes the script remotely, initiating the BEST installation on the selected Windows devices.

[![Screenshot of Hexnode UEM dashboard showing the output of ‘Execute Custom Script’ remote action from Action History sub-tab, located between ‘Device Groups’ and ‘Remote View/Control’ sub-tabs.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/06/Output-after-executing-the-PowerShell-script-to-deploy-BEST.png)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/06/Output-after-executing-the-PowerShell-script-to-deploy-BEST.png "Output after executing the PowerShell script to deploy BEST")