Chapter 38
Installing the Windows Agent
This chapter covers the manual installation of the agent in a Windows environment.
This appendix includes the following topics:
See Manually Installing the Windows Agent on page 485.
See Using Your Own Certificates on page 491.
Manually Installing the Windows Agent
Perform the following steps to manually install the Enterprise Agent in Windows:
See Preparing the AD Enterprise Agent Certificate on page 485. (AD Enterprise only)
See Installing the Agent on page 486.
See Configuring Execname and Servicename Values on page 489.
Preparing the AD Enterprise Agent Certificate
About Enterprise Security Certificates:
When installing AccessData Enterprise Examiner, you need a security certificate. Enterprise Management
Server creates Enterprise security certificates, the CRT public key and the PEM public and private key pair files.
However, the Enterprise Configuration Management Tool now also accepts PKCS#12 certificates.
If you have a third-party certificate chain in the PKCS#12 format, the Enterprise Configuration Management Tool reads the PKCS#12 certificate and asks for the user password. The certificate is decrypted only long enough to gather the information necessary for the Enterprise installation, then re-encrypts the private key. The public key, regardless of source, must be in standard binary or base-64 encoding.
If the Agent is installed, or pushed, to the workstations using Enterprise, the certificate information will automatically be read from the Enterprise Configuration Management Tool. If the Agent is pushed out, the certificate information (paths and filenames) must be re-entered. The public certificate itself must be in an area of the network where it can be accessed by the Agent machine during installation, but does not need to be stored on the Agent machine.
In addition, the Agent uses only a public key. As long as that public key is in binary or base-64 format, it will
automatically be read by the Agent. For more information, see Using Your Own Certificates (page 491).
Installing the Windows Agent Manually Installing the Windows Agent | 485
To prepare the certificate
1.
2.
3.
Prepare the Agent Certificate.
Copy the needed certificate from the Management Server to your deployment location.
Management Server creates certificates during the setup in:
[Drive]:\Program Files\AccessData\AccessData Management Server\certificates.
The certificate name is the
ManagementServer.crt.
Copy
ManagementServer.crt to a folder of your choice where it can be accessed while installing the
Agent.
Installing the Agent
To install the Agent
1.
Run
AccessDataAgent.msi or AccessDataAgent(64bit) using msiexec.
Note: These
.msi
files are located in the
Program Files\AccessData\Forensic Toolkit\5.1\Bin\Agent\<x32 or x64> folder after installation.
There are several command line parameters available to use with this
.msi as documented below. Here is an example command line that will install with the defaults:
If
AccessDataAgent.msi resides in the folder C:\enterprise and ManagementServer.crt resides in
[Drive]:\certificates, type the following command line to install the agent with defaults: msiexec /i [Drive]:\enterprise\AccessDataAgent.msi
CER=[Drive]:\certificates\ManagementServer.crt.
The following table lists the command line options available for use with this
AccessDataAgent.msi:
Command Line Options
Option
/i (i or x required)
/x (i or x required)
/qn (optional)
< path and msi file name
>
(required)
CER=<path and certificate file name> (required)
ALLUSERS=<n>
INSTALLDIR=< custom install path
> (optional)
PORT=<xxxx> (optional)
Action
Specifies install.
Specifies un-install.
Allows you to install in quiet mode with no user interaction.
If running from the folder where the
.msi
is located you do not have to include path, only the filename.
Specifies the certificate the agent uses.
Always include the path, regardless of location
.
Configures the installer to be available to all users. The default option varies per operating system.
The options are:
allusers=1
configures the installer to be available to all users.
allusers=0
configures the installer to be available to only the user who is installing the agent.
Allows you to change the install location from the default folder:
(
C:\Program Files\AccessData\Agent
).
Allows you to change the port from the default port (3999).
Installing the Windows Agent Manually Installing the Windows Agent | 486
Command Line Options (Continued)
Option
LIFETIME=<d> (optional)
CONNECTIONS=<n>
STORESIZE=<n>
TRANSIENT=1
FOLDER_STORAGE=1
SERVICELESS=1
PCD=<x > (optional)
PROXY= (see example below)
(optional)
<PrimaryIP>,<SecondaryIP>:<Port
>~<PrimaryIP2>,<SecondaryIP2>:
<Port2>
Action
Allows you to configure the life cycle of the agent. The “d” value equals the Time To Live (TTL) measured in days. Adding a number preceded by a dash measures the TTL in minutes. For example: <-d >.
Allows you to configure the number of maximum connections for the agent.
Allows you to configure the size of the data store.
Allows you to configure the agent as a Transient Agent. Transient
Agents have no protected storage and remove themselves when the agent machine is restarted.
Allows you to configure the agent as a Persistent Agent. Persistent
Agents use a “local” file system based storage and not protected storage. Persistent Agents also remain on the agent machine after the machine is restarted.
This allows for local logical disc space to store the results of Public Site
Server jobs operating while the Agent is not on the WAN or can get to the Public Site Server.
Allows you to configure the agent to install with no protected storage and no installed service. The agent removes itself when the agent machine restarts or when the lifetime option expires, whichever comes first.
Enterprise Only: Allows you to configure the Proxy Cycle Delay
(PCD). The PCD is the time interval at which the agent attempts to connect to proxy to check if any work has been assigned. The PCD “x” value is measured in seconds. The default is 1200 (20 minutes).
Enterprise Only: Allows you to configure a proxy-able agent.
PrimaryIP should refer to the IP address to which the agent should try to communicate. (Usually this will be the internal private network IP of the proxy server.)
The “SecondaryIP” should refer to the IP address to which the agent should try to connect when the attempts to connect to the “PrimaryIP” have failed. (Often this IP will represent the public IP of the proxy server.)
PrimaryIP2 and SecondaryIP2 should refer to an additional proxy server address and is delimited by a tilde (~). Additional proxy servers can be added by following this same pattern.
Installing the Windows Agent Manually Installing the Windows Agent | 487
Command Line Options (Continued)
Option
MAMA=<Site Server IP address:port>
PUBSS=<public instance IP>
PUBSS_DELAY=<seconds>
Action
Resolution1, Resolution1 CyberSecurity, and Resolution1
eDiscovery Only: Allows you to configure the IP Address of the Site
Server to which the agent reports.
For example, 10.32.41.113:54545
This parameter is used so that the Agents know which Site Server to check into for the first time. Additionally, after that first check-in, the
Agents will learn the Site Servers that has its CIDR and check there next time. It will update based on movement of the physical IP of the node.
Resolution1, Resolution1 CyberSecurity, and Resolution1
eDiscovery Only: Allows you to configure the agent to connect to a
Public Site Server (PUBSS). See About Site Servers on page 38.
For example, pubss=192.192.192.192:5432
The Agent in Public Site Server (PUBSS) mode will check-in to the original PUBSS value that was part of the install. After that first checkin, it will receive a list of other Public Site Servers in the DMZ and then ping around to find the closest/fastest connection.
For example, if the user is in New York and a job starts there, and then the user goes to Los Angeles, the user will go from the NYC PUBSS to the LA PUBSS and the collection should resume and support interruption. This is all completed based on the resolution of the IP address for the target and assignment in a proper CIDR range on Site
Server config.
See Site Server Configuration on page 41.
This list will also get updated whenever it might change. This list comes from the Site Server configuration parameters you setup on your internal servers and not specifically some additional data entry. It comes from the virtue of having any Public Site Servers deployed.
See MAMA=<Site Server IP address:port> on page 488.
Resolution1, Resolution1 CyberSecurity, and Resolution1
eDiscovery Only:
This can be used to delay the default check-in interval (30 minutes).
You may want to alter this value if you have a lot of Agents on the
PUBSS system.
Example Command Line Install
msiexec /i "C:\AgentInstall\AccessData Agent (64-bit).msi” cer=”C:\AgentInstall\AccessData E1.crt” mama=10.10.35.32:54545 TRANSIENT=1 Persistent=1 Serviceless=1 lifetime=1 or lifetime=-5 pubss=192.192.192.192 5432
Installing the Windows Agent Manually Installing the Windows Agent | 488
Configuring Execname and Servicename Values
The Execname and Servicename values change the names of the agent executable and agent service respectively. These values are added to the MSI using an MSI editor (such as
ORCA.exe — a free MSI editor).
Changing the Execname Value
To make changes to the execname value
1.
Run
Orca.EXE.
2.
3.
4.
5.
Click File > Open.
Browse to the folder containing the “
AccessData Agent.msi” or “AccessData Agent (64-bit).msi” file and open the file. The default path is:
[Drive]:\Program Files\AccessData\Forensic Toolkit\3.2\Bin\Agent\x32 (or x64)\
In the Tables list, select File...
In the FileName column, double-click “ u4jwdc7h.exe|agentcore.exe”.
5a.
Enter the filename to use for the agent core executable.
Note: Replace the entire string with the filename.
6.
7.
Press Enter.
Click File > Save.
Note: Do not close Orca if you are also changing the service name.
Changing the Servicename Value
To make changes to the Servicename value
If you closed Orca, begin with Step 1. Otherwise, skip to Step 4.
1.
2.
3.
4.
5.
Run
Orca.EXE.
Click File > Open.
Browse to the folder containing the “
AccessData Agent.msi” or “AccessData Agent (64-bit).msi” file and open the file. The default path is:
[Drive]:\Program Files\AccessData\Forensic Toolkit\3.2\Bin\Agent\x32 (or x64)\
In the Tables list, select “ServiceControl”.
In the Name column, double-click “AgentService”.
5a.
Enter the name to use for the AgentService and press Enter.
Note: Use the same value in steps 5a, 7a and 8a.
6.
7.
8.
In the Tables list, select “ServiceInstall”.
In the Name column, double-click “AgentService”.
7a.
Enter the name to use for the AgentService (use the same value entered in step 5a) and press
Enter.
In the DisplayName column, double-click “AgentService”.
Installing the Windows Agent Manually Installing the Windows Agent | 489
9.
8a.
Enter the name to use for the AgentService (use the same value entered in steps 5a and 7a) and press Enter.
Click File > Save.
10.
Click File > Close.
Installing the Windows Agent Manually Installing the Windows Agent | 490
Using Your Own Certificates
Definitions:
PKCS#12: Standard certificate packaging to securely transfer public/private key pairs
PKCS#7: Standard certificate package to store certificates for S/MIME encryption. We are using for storing sets of public key chains.
To export the public certificate when using a PFX (PKCS#12) key
1.
Using the PKCS#12 provided by the Certificate Administrator, double-click PKCS#12 to open it.
2.
3.
Install the certificate into a local Microsoft certificate store by following the wizard supplied when you double-click the certificate file.
View the public certificate of the installed certificate by opening the local machine’s certificate store.
(This can be done with Microsoft Management Console or in Internet Explorer under Tools > Internet
Options > Content > Certificates)
4.
5.
6.
Find the bottom level certificate and double-click the certificate to view it.
Click the Certification Path tab to verify that the certificate has a full verification path, meaning that nothing is missing from the top of the chain to the bottom.
Click the Details tab and click Copy to File.
Click Next and click Cryptographic Message Syntax Standard - PKCS #7 Certificates.
7.
8.
9.
Select Include all certificates in the certificate path if possible.
Click Next and enter a file export path.
10.
Click Next.
11.
Click Finish.
12.
Double-click the exported PKCS#7 and verify that all of the public certificates in the chain are in the
PKCS#7.
The exported file you created will be used as the certificate for the agent installation.
Installing the Windows Agent Using Your Own Certificates | 491
Controlling Consumption of the CPU
You can edit a registry key that allows you to control what percentage of the CPU is used for the agent. This gives you the ability to throttle the CPU and insure that the agent does not consume all of the CPU available.
To add a throttling registry key
1.
2.
In the Registry Editor, expand the
HKEY_LOCAL_MACHINE hive and locate the
HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Shared folder.
Add a new
DWORD (32-bit) value to the Shared folder.(
HKEY_LOCAL_MACHINE\SOFTWARE\AccessData\Shared\throttling)
3.
The data value of the DWORD should be the maximum percentage of the CPU allowed to be used by the module. For example, if you want the maximum percentage of the CPU used to be 25 percent, modify the DWORD data value and enter 25 in the Edit DWORD dialog. The value should be from 0-
100. If the data value is left at 0, the CPU will not be throttled when the agent is started.
4.
5.
In the Edit DWORD dialog, select the Decimal radio button and click OK.
After applying the registry key changes, restart the agent service.
For more information on adding and editing registry keys, see Microsoft’s documentation.
Installing the Windows Agent Controlling Consumption of the CPU | 492
Resolution1 eDiscovery Additional Instructions
1.
2.
3.
4.
5.
Obtain the public key and private key pair (pfx and cer).
Copy the private certificates to the collection workers. The only certificates that need to be changed are the ones that talk with the agent (collectors).
2a.
(Optional) You can make the certificates available to the processing worker in the event you want to use it for collection testing in the interim.
Run
CollectorCfgTool.EXE:
[Drive}:\[Program Files]\AccessData\eDiscovery\WorkManager\.
3a.
3b.
Select the new private key.
Provide the password.
3c.
(Optional) Delete the original private key.
Uninstall the agent:
4a.
Click Start > Control Panel -> Add or Remove Programs.
4b.
If the previous agent was installed using the “allusers” option, you must use the following to uninstall from the command prompt using msiexec msiexec /x [Path to Installer]Adagentinstaller.msi
Install the agent:
5a.
Assuming the Certificates are installed on the C: drive, in the Run Command box, type: msiexec /i [Path to Installer]Adagentinstaller.msi CER=”[Full Path to Certificate File]”
Installing the Windows Agent Resolution1 eDiscovery Additional Instructions | 493
Important Information
The following information is important to know about installing and executing an agent:
The ADMON module does not run on low resource priority. The ADMON module must run on Normal priority or higher in order to maintain connection to the system drivers.
Installing the Windows Agent Important Information | 494
