Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

while creating the agent can we change the path of the folder osquery is installed to?

i am using fleetctl.
When pushing new agent it fails and most likely error is that it sees the older folder is there and it is not able to replace it.

So how do i change the path to different one like orbit2 or something

Hi <@U02MSR4801Y> !

&gt; while creating the agent can we change the path of the folder osquery is installed to?
Currently, no. `fleetctl package` has paths hardcoded.

&gt;  When pushing new agent it fails and most likely error is that it sees the older folder is there and it is not able to replace it.
We've recently released a fix that will make the installer remove any previously existing installation on Windows.
But it probably works for new installs, not existing installs.

Hey <@U02J4JCKDL2>
I am having issue with deployment of the updated package by intune.

Because the path already exeists agent is not getting installed.
&lt;![LOG[[Win32App] Admin did NOT set mapping for lpExitCode: 1603 of app: 255bbb69-95ec-4d07-91ae-3fe8a898736e]LOG]!&gt;&lt;time=“16:41:34.3850981” date=“4-17-2023" component=“IntuneManagementExtension” context=“” type=“2” thread=“113" file=“”&gt;

<@U02J4JCKDL2> how do i remove the existing ones and update the agent to new one :neutral_face: ?

Good question. Does Intune allow removing directories?

AFAIK, the fix we recently added works moving forward (will not fix current installations.)

yea i tried doing it with a powershell script but it still throws the same error.

This is the issue we've fixed recently: <https://github.com/fleetdm/fleet/issues/3563>

Did you try (1) uninstall Orbit followed by (2) removal of the directory?

yea i altered the powershell provided for uninstall and it works in uninstalling.
and removing the directly afterwards
.
but get same error. Maybe registry or other things are present?

What's the exact error? (Sorry, it's a big log file :)

Also when i am manully installing the new agent
it uninstalls the older one and then throws error saying wasnt able to install.

Huh, ok, so it's not an issue with Intune

Can you share any logs you may find when installing manually?

So we shared the error code with microsoft as well and they came back saying because older agent is there so new is not installing

Let me try again instaling the agent and will capture the logs