Various properties of the Agent installer MSI can be changed using an MSI editor. This can be done to make pre-modified Agent installers for pushing Agents, rather than having to manual install the Agent to specify the parameters.
The following steps assume the use of Orca (attached), a free MSI editor from Microsoft, but any MSI editor should work.
Notes:
- The Windows Agent MSIs can typically be found in "%ProgramFiles%\AccessData\Forensic Toolkit\\bin\Agent\x86" and "%ProgramFiles%\AccessData\Forensic Toolkit\\bin\Agent\x64"
- We recommend backing up the original Agent installer prior to editing it.
To change the Agent executable's name:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select File
- Find the "agentcore.exe" row.
- In the FileName column, double-click "u4jwdc7h.exe|agentcore.exe".
- Replace the entire string with your desired executable name.
- Press Enter.
- Click File > Save.
To change the Agent service's name:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select ServiceControl.
- Find the "AgentServiceConfig" row.
- In the Name column, double-click "AgentService".
- Replace the entire string with your desired service name and press Enter.
- In the Tables list, select ServiceInstall.
- Find the "AgentServiceInstall" row.
- In the Name column, double-click "AgentService".
- Replace the entire string with the same service name as used in step 6 and press Enter.
- In the DisplayName column, double-click "AgentService".
- Replace the entire string with the same service name as used in step 6 and press Enter.
- Click File > Save.
- Click File > Close.
To make the Agent transient/temporary:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select Property
- Find the "TRANSIENT" row.
- In the Value column, double-click "0".
- Replace the "0" with the number "1".
- Press Enter.
- Find the "LIFETIME" row.
- In the Value column, double-click "0".
- Replace the "0" with a number denoting the desired lifetime. A negative value is used to denote minutes (eg. -30 denotes 30 minutes), and a positive value is used to denote days (eg. 30 denotes 30 days).
- Press Enter.
- Click File > Save.
To make the Agent use Folder Storage rather than Protected Storage:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select Property
- Find the "FOLDER_STORAGE" row.
- In the Value column, double-click "0".
- Replace the "0" with the number "1".
- Press Enter.
- Click File > Save.
To make the Agent able to check-in to a Public Site Server:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select Property.
- Right-click in the list on the right, and click Add Row.
- Set the Property to PUBSS and the Value to the external address of your Public Site Server, followed by 54545, and click OK.
- Click File > Save.
To make the Agent able to check-in to a Root/Private Site Server:
- Install and run Orca.
- Click File > Open.
- Browse to the folder containing the Agent MSI and open the MSI.
- In the Tables list, select Property.
- Right-click in the list on the right, and click Add Row.
- Set the Property to MAMA and the Value to the address of your Root/Private Site Server, followed by 54545, and click OK.
- Click File > Save.