Skip to content

fix: improper error handling when OpenAEV agent installation is blocked by EDR #158

Description

@sairam-jetty-filigran

Description
When attempting to install the OpenAEV agent on an endpoint protected by an EDR solution, the agent installer binary (agent-installer-session-user.exe) is blocked from executing. The EDR flags/prevents the binary from running, resulting in an "Access is denied" error. This is expected behaviour from the EDR's perspective (blocking unknown/unsigned binaries), but there is no guidance or workaround documented for deploying the agent in EDR-protected environments.

Expected Output

The agent installer binary should execute successfully, or throw proper error to be able to understand the issue and troubleshoot accordingly.

Actual Output

powershell
Copy
Note: PowerShell 7 or higher is recommended. If the issue persists, consider upgrading.
Program 'agent-installer-session-user.exe' failed to run: Access is deniedAt line:45 char:5

  • ./agent-installer-session-user.exe /S ~OPENAEV_URL="http://localh ...
    

⚠️ Generation error detected — repeated output was truncated. Please retry.

~~.
At line:45 char:5

  • ./agent-installer-session-user.exe /S ~OPENAEV_URL="http://localh ...
    
  • ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    • CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
    • FullyQualifiedErrorId : NativeCommandFailed

Impact: Prevents agent deployment entirely in EDR-protected environments without manual intervention (whitelisting).

Suggested improvements:

Provide official documentation on required EDR exclusions/whitelists for the agent binary
Error handle to show more approriate error message to be assist troubleshooting

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugType: something isn't working (fix:).

    Type

    Fields

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions