Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Anyone had issues with the latest agent msi installer? It was built on a mac. When I try to install using an msi on a test host just by double clicking, it runs then just closes. Looking at the logs, it seems like it tries to run an uninstall script and fails there, but I'm not adept at reading MSI logs. I've never successfully installed the agent on this device and checking in the usual places doesn't show any remnants of an install.

I have a previous version that's working, but I had to incorporate disabling Windows Defender SmartScreen then re-enabling it into the deployment because it's not signed. I think the newest version is supposed to be signed?

I think I found the issue, looks like it was the `installer_utils.ps1 -uninstallOrbit` portion of the install.

This line (310): `$properties = Get-ItemProperty $_.PSPath  -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "Fleet osquery")}`

And this line (352): `$properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "osquery")}`

Seem to have problems with registry keys in `HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall` that have brackets (probably other special characters?), in our case a BeyondTrust Remote Support key.

Adding `-LiteralPath` got me the desired result (`Orbit was uninstalled.` :wink: )

Corrected commands (respectively):

`$properties = Get-ItemProperty -LiteralPath $_.PSPath  -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "Fleet osquery")}`

`$properties = Get-ItemProperty -LiteralPath $_.PSPath -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "osquery")}`

a PR <https://github.com/fleetdm/fleet/blob/223e1f23620df9f12bc523ed0ce0ab6cb0d29ae2/orbit/pkg/packaging/windows_templates.go#L574> and <https://github.com/fleetdm/fleet/blob/223e1f23620df9f12bc523ed0ce0ab6cb0d29ae2/orbit/pkg/packaging/windows_templates.go#L616> would be clutch!

I gotta run, but I forked the repo earlier and will try to get one in this weekend

PR submitted: <https://github.com/fleetdm/fleet/pull/19946>