Skip to content
  • There are no suggestions because the search field is empty.

Confirming upgrade of the NetWitness Endpoint / Insights Agent from the registry

Issue

Verification using SCCM or other tools that bulk push out updates may be difficult to verify that they have been performed successfully. Since the agent rolls back failed upgrades, the version number in the registry should still show the old agent version. Hence, targeting the DisplayVersion and InstallDate registry values may yield information about the agent.


Cause

The causes for agent failure to install have multiple reasons and are not necessary for this article's discussion.


Resolution

Using SCCM or another software solution, verify the output of the following registry keys:
 
  1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63AC4523-5F19-42F0-BC43-97C8B5373589}\DisplayVersion
  2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{63AC4523-5F19-42F0-BC43-97C8B5373589}\InstallDate
The first value will have a version number in the following format: 12.3.1.0
Use this to verify the version of the agent
The second value will have an install date in the following format: 20240214
Use this to verify the installation date of the agent in conjunction with its reported version number

Taken together, it becomes possible to verify if an agent upgrade succeeded or failed as these values would rollback to their previous entries if an installation fails. Note this applies to upgrades mainly; for fresh installs, a separate registry key located in the services directory called ServerSS is useful to determine if the agent checked in to the server after installation.

image.png
 

Notes

To the Uninstall registry location, it is identical between the original Endpoint agent, and the Insights agent, although the values will be different in some cases. The two values used in this article do not change, so both can be treated the same for testing if an upgrade succeeded or failed.


Internal Comments

Updated to reflect Endpoint information rather than ECAT.


Product Details

NetWitness Product Set: NetWitness Endpoint
NetWitness Product/Service Type: NetWitness Endpoint
NetWitness Version/Condition: Endpoint Agent 11.1.x-11.2.x
Platform: Windows

Summary

For SCCM purposes, it may be desired to confirm the upgrade status the NetWitness Endpoint agent from the Windows registry. If so, this can be done by targeting a specific set of registry entries.


Approval Reviewer Queue

Technical approval queue