Agilicus Connector

Versions Supported

The Agilicus Connector will run on any version of Windows XP or later. However, prior to Windows 10, the ‘curl’ command, used as part of the install, was not present, and you may need to manually install it.

If your Windows version is old or unpatched, it may be missing the Let’s Encrypt Intermediate certificate, see https://letsencrypt.org/certificates/

Installation

Windows 10 and later come with a command pre-installed called ‘curl‘ that allows for 1-click automatic install.

To create and install a connector, first, on your desktop PC (where you have the ADMIN url open), go to ‘resources/connectors/new’. Give your connector a name that means something to you (often the name of the machine you will install it on, or the site that it connects).

Click ‘create’. You will now be given the option to ‘Install Connector’. This brings up a dialog box as below. Select ‘WIndows – CMD’.

There is only 1 question on this dialog “This is a subsequent connector (create a cluster)”. Select this if you have more than one computer running the same connector instance in a high-availability cluster.

Select the ‘COPY’ button. This will place the command line into your clipboard.

At this stage we must switch to the computer where you will run the connector. It might be this same machine, it might be another accessible via Remote Desktop or VNC.

On the target computer, open a ‘Command Prompt’ as administrator:

1. Go to ‘Start’
2. Type ‘cmd’
3. Right click ‘Command Prompt’
4. Select ‘Run as administrator’

This will open a ‘cmd’ shell.

We can quickly test that ‘curl’ is installed by running ‘curl ifconfig.me’. This will print our current public IP address. Curl is pre-installed as part of Windows as for Windows 10 and Windows 2016. If you do not have curl installed, you may try the PowerShell instructions from the dialog, or, install curl manually.

C:\WINDOWS\system32>curl ifconfig.me
99.250.30.222

We can now paste the command we obtained from the ADMIN UI.

Paste the command as below. The correct output will be similar to what is shown, ending in ‘Installation Complete’

It is possible you will run into some errors, the most common relate to:

1. Time setup. Your computer should be time-synced (using NTP). This is important for proper cryptography.
2. Firewall. Your computer may block outbound access to https://www.agilicus.com
3. Intermediate Certificate. If your computer has not run Windows update since 2021, it may be missing the Let’s Encrypt intermediate certificate.

At this stage you are complete and may close the command window.

In the ADMIN UI you can check the status of your connector, it should move to ‘GREEN/GOOD’ (you may need to refresh this screen).

General Notes

Diagnostic Logs – Windows Eventvwr

The Agilicus Connector sends diagnostic and access logs to Windows Eventvwr by default. To view these logs on a standalone-basis, you might consider creating a custom view.

1. Open Microsoft Windows eventwr (from Start menu, type ‘eventvwr’)
2. Right click in custom views
3. Create Custom View
4. Select ‘By Source’, and ‘agilicus-agent’. Enable each Event Level of interest (e.g. Critical, Warning)
5. Save as ‘Agilicus Connector Logs’

Once this is complete, you will see a new custom view as below. You may then browse the logs or e.g. right-click and save a text file for forwarding.

File Permissions Correction

If your connector shows a warn status, it could mean that the file does not have sufficient permission for Agilicus’ connector. To give access files/folders the correct permissions, 

Automatic Permission Fix Instructions

Download and run this script (in Powershell) as access.ps1, or, follow the manual instructions below.

$path="C:\Program Files\agilicus"
$user=Get-CimInstance -Class Win32_service -filter "Name = 'agilicus-agent'"| select -expand startname
if ( $user -Match "LocalSystem" ) { $user="NT AUTHORITY\SYSTEM"}
$acl = Get-ACL -Path $path
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($user,"FullControl","ContainerInherit,ObjectInherit","None","Allow")
$acl.SetAccessRule($AccessRule)
$acl.SetAccessRuleProtection($False,$True)
$acl | Set-Acl -Path $path

Manual Permission Fix Instructions

See which user accounts are running the service

1. Right-click on the Start button to open the WinX Menu
2. Select Run
3. Type services.msc in the Run box which opens
4. Windows Services Manager will open.
5. Under the Name column, you will see Agilicus Connector
6. You will see the user running this service in the Log On As Column

Update the Folder with correct user/permissions

1. Right-click the folders (Typically “C:\Program Files\agilicus”)
2. Select Properties. The Properties dialog box appears.
3. Access the Properties dialog box.
4. Select the Security tab.
5. Click Edit. The security tab opens in a new window.
6. Click Add… The Select Users, Computers, or Groups dialog box appears.
7. In the Enter the object names to select text box, type <username> and check
8. Click OK. The Properties dialog box reappears.
9. Click OK on the Security window.
10. Access the Properties dialog box.
11. Select the Security tab.
12. Click Edit
13. In the Group or user name section, select <username> 
14. In the Permissions section, use the checkboxes to select Full control Allow
15. Click Apply
16. Click Okay