Problem

AD Enterprise fails to push modules after pushing the Agent, or when trying to update the modules during a collection.


 

Possible Causes

  • The Agent service isn't started on the target
  • The Examiner machine isn't able to communicate with the Agent target over port 3999. Test the port communication.
  • SSL traffic isn't allowed over port 3999
  • The "Agent Push" settings in Enterprise are incorrect
    From within a case, go to Tools > Configure Agent Push to check the paths:
    Path to UNC share: \\ADMIN$\temp
    Local path to shared folder: %systemroot%\temp
    Path to trusted modules certificate: [Forensic Tools Install Folder]\bin\Agent\modules\adata.p7b
    Path to agent modules: [Forensic Tools Install Folder] \bin\Agent\modules
  • The Modules certificate is expired
  • Additional causes may be found the the FTK logs located at %PROGRAMDATA%\AccessData\Products\Forensic Toolkit\<version> .