Windows Agent Installation

Windows Agent Installation Instructions

System Requirements

The LimaCharlie.io agent supports Windows XP 32 bit and up (32 and 64 bit). However, Windows XP and 2003 support is for the more limited capabilities of the agent that do not require kernel support.

Installing via MSI

Windows Installer is an installation and configuration service provided with Windows. Microsoft Software Installer, or MSI, files allow for an easy and portable installation format on Windows systems.

LimaCharlie makes portable MSI files available with each new sensor release. They are available at a static URL for easy downloading:

• 32-bit MSI installer

• 64-bit MSI installer

Similar to executable installation, when installing with an MSI, you will need to provide the desired Installation Key, passed through as the InstallationKey variable.

32-bit MSI installation command:

hcp_win_x86_release_<sensor_version>.msi InstallationKey=<installation_key>

64-bit MSI installation command:

hcp_win_x64_release_<sensor_version>.msi InstallationKey=<installation_key>

Executing the installer via the command line, pass the -i INSTALLATION_KEY argument where INSTALLATION_KEY is the key mentioned above. This will install the sensor as a Windows service and trigger its enrollment.

You may also install the Windows sensor using the MSI version. With the MSI, install using:

installer.msi InstallationKey="INSTALLATION_KEY"

You may also pass the value - instead of the INSTALLATION_KEY like: -i -. This will make the installer look for the installation key in an alternate place in the following order:

• Environment variable LC_INSTALLATION_KEY

• Text file in current working directory: lc_installation_key.txt

Verify the service is running

In an administrative command prompt issue the command sc query rphcpsvc and confirm the STATE displayed is RUNNING.

Uninstalling the Agent

For additional agent uninstall options, see Endpoint Agent Uninstallation

Manual Uninstallation

Windows EXE

On Windows, the LimaCharlie sensor can be uninstalled on individual endpoints by running the installer EXE with the -c argument, which will remove the Sensor and its service entirely.

Example:

C:\Windows\System32\rphcp.exe -c
del C:\Windows\System32\rphcp.exe

Windows MSI

If uninstalling via the Windows MSI installer, the /x switch can be used to uninstall.

Example:

msiexec /x lc_sensor.msi /qn

If you run into issues where the service is still present (sc.exe query rphcpsvc) or the exe is still left behind (C:\Windows\System32\rphcp.exe), you can remove them with the following:

C:\Windows\System32\rphcp.exe -c       # If this throws an error about the service, it's safe to ignore
del C:\Windows\System32\rphcp.exe