I had a similar problem, but ended up deploying the agent via GPO, you can enforce USB defender service with silent install and it is hassle free
https://thwack.solarwinds.com/docs/DOC-190786#comment-310105
The great thing with this method is that it also allows you to upgrade the LEM agent through the same GPO too.
Just few days ago, i upgraded all the agents by simply replacing 6.5.0 with 6.6.0. Couldn't get any easier
@echo off
:CheckOS
IF EXIST "%PROGRAMFILES(X86)%" (GOTO 64BIT) ELSE (GOTO 32BIT)
:64BIT
IF EXIST "C:\Windows\SysWOW64\ContegoSPOP\6.6.0" (GOTO END) ELSE (GOTO Install)
:Install
\\server\share\lem-setup.exe -i silent
GOTO END
:32BIT
IF EXIST "C:\Windows\System32\ContegoSPOP\6.6.0" (GOTO END) ELSE (GOTO Install)
:END