Do you know how it was deployed then Maybe an administrative

Question

Do you know how it was deployed then Maybe an administrative install was used What is the version of the old agent Do you still have the osquery service

Ojas · Answer

4 8 0 is the version

Ojas · Answer

it was installed with admin privs when host was setup at the very begninng

Ojas · Answer

its running with osqueryd service

Stefano Bonicatti · Answer

With administrative install I mean something like `msiexec A osquery 4 8 0 msi` which will not add a reference to the Add Remove program but also it will not add an osquery service on its own which has to be later added manually

Stefano Bonicatti · Answer

Otherwise I m not sure why it s not in the list of Add Remove programs in any case you can also remove it manually if there s no reference of it From an admin powershell you can ```Stop Service Name osqueryd Remove Service Name osqueryd``` Then go to the osquery installation folder and make a copy of any config you want to keep if any then just delete the osquery folder and install the new one

Stefano Bonicatti · Answer

The installer beyond adding a reference to the Add Remove programs adding a service and installing the files doesn t do anything else

Ojas · Answer

Hey thanks for your input i am gonna try to stop the service and remove the folder one

Stefano Bonicatti · Answer

To be specific among the configs remember that there s also the osquery database which may contain the node identifier if it was enrolled into a fleet manager

Stefano Bonicatti · Answer

You maybe want to carry that over too so that it s already enrolled and depending on what you ve selected as identifier it doesn t regenerate

Stefano Bonicatti · Answer

There s something I still don t understand though osquery 4 8 0 MSI should install under `C Program Files osquery` which is the same path used by newer installations When you have tried previously to install the newer version what do you mean that it installed it as a separate application

Stefano Bonicatti · Answer

separate in what way

Ojas · Answer

Separate as in i see both the osquery agents there 5 2 and 4 8

Stefano Bonicatti · Answer

Could you clarify where there is

Ojas · Answer

There as in installed on the machine If i see installed apps services on my host it shows both osquery agents

Stefano Bonicatti · Answer

How are you verifying that

Ojas · Answer

i can see the device on osquery

Ojas · Answer

and in apps installed it shows both agents