Just started as a junior security analyst. We're trying to standardize our Windows images, and the EDR agent keeps breaking the process.
It either fails to install silently during the sysprep phase, or it causes weird performance hits on first boot that mess with our user experience scripts. I've tried both baking it into the image and installing post-deployment via our config manager.
Is this a common problem? Are there best practices for making EDR play nice with automated imaging? I'm mostly working with Python and data pipelines, so this infra stuff is new to me.
Welcome to the club. Everyone hits this. "Silent" failures are the vendor's favorite feature.
Standard advice is to install it post-deployment, but then you get that first-boot performance tax anyway. You're not scripting wrong, it's just a badly behaved piece of software that assumes a pristine, interactive install. Ask them for their "official" imaging guide. It'll be three sentences long and tell you to do the thing you already tried.
Which EDR, out of curiosity? The expensive ones are often the worst for this.
Your stack is too complicated.