Problem
AD Enterprise fails to push modules after pushing the Agent, or when trying to update the modules during a collection.
Possible Causes
- The Agent service isn't started on the target
- The Examiner machine isn't able to communicate with the Agent target over port 3999
- SSL traffic isn't allowed over port 3999
- The "Agent Push" settings in Enterprise are incorrect
From within a case, go to Tools > Configure Agent Push to check the paths:
Path to UNC share: \\ADMIN$\temp
Local path to shared folder: %systemroot%\temp
Path to trusted modules certificate: [Forensic Tools Install Folder]\bin\Agent\modules\adata.p7b
Path to agent modules: [Forensic Tools Install Folder] \bin\Agent\modules - The Modules certificate is expired
- Additional causes may be found the the FTK logs