Introduction

The macOS Managed Agent may use either port 4999 or 3999 by default, depending on the version of the Agent.  In order for Enterprise to be able to communicate with the Managed Agent, you the Examiner machine's port settings must match the Agent.  You can also specify a different port than 4999 or 3999, if desired.

 

Procedure

On the macOS endpoint:

  1. Stop the Managed Agent service by running the command below in a Terminal window: 
    sudo launchctl unload /Library/LaunchDaemons/com.adg.managedagent.plist
  2. Navigate to "/Library/AccessDataAgent/"
  3. Open appsettings.json with a text editor
  4. Change the "port" key to the desired value, and save your changes
  5. Start the Managed Agent service by running the command below in a Terminal window: 
    sudo launchctl load /Library/LaunchDaemons/com.adg.managedagent.plist

On the Enterprise Examiner machine:

  1.  Stop the AccessData Quin-C Self Host Service service
  2. Navigate to the Forensic Tools bin folder (typically ":\Program Files\AccessData\Forensic Tools\\bin")
  3. Open ADG.WeblabSelfHost.exe.config with a text editor
  4. In the section, change the value of the "MacAgentDefaultPort" key to match the port used by the macOS Managed Agent, and save your changes
    Note: If the "MacAgentDefaultPort" key does not already exist, you can add it following the example below
  5. Start the AccessData Quin-C Self Host Service service

 

Notes

  • You can verify the ability for the Examiner to communicate with the Agent by going to https://:/api/hostname in a web browser on the Examiner.
  • "MacAgentDefaultPort" is a global setting, so all masOS Managed Agents must use the same port.