Scanning an offline endpoint

NAVIGATION   > Organizations > select an organization > select a location >  > Download Agent

SECURITY   Datto EDR subscription with administrator-level platform access or Datto AV subscription with administrator-level platform access

SECURITY   Service account or administrator-level rights on the target endpoint

If an endpoint cannot connect to the internet due to a network outage or because of security considerations, you can perform manual offline scans of the host and use the Import-ICSurvey function to upload the results to our analysis engine for review.

IMPORTANT  An endpoint must have the agent software installed and be associated with a location before our analysis engine can scan it.

What you'll need

  1. USB storage drive, readable by the offline endpoint, with at least 512 MB free storage

  2. Administrator-level command prompt access to the offline endpoint

  3. Access to a USB-enabled computer capable of reading the flash drive and connecting to the internet

Download the agent executable

  1. Log in to your EDR instance. In the top navigation menu, click Organizations.

  2. Select the organization and the location to which you'll be deploying the agent. For more information, refer to Creating and managing organizations, locations, and devices.

  3. From the Location page, click the menu above the Location Details pane. Then, select Download Agent.

  4. The Download Agent modal will open.

  5. Select the installer that matches your endpoint's operating system.

    • To download the agent to your current computer, click Download.

    • To copy the installer's unique download link for use on another endpoint or to include in an installation script, click Copy Download Link.

    IMPORTANT  The download link is location-specific. You should not use it to deploy the agent to other locations in your organization.

  1. Copy the installer to a USB drive. Alternatively, you can email the executable to an end user if you cannot be on site and need them to run the process remotely.

  1. Connect the USB drive to the offline endpoint and open a Command Prompt or Terminal session as an administrator. Then, select a topic to continue.

Running the scan

  1. From the command line, change your working directory to the executable's location and run the following command.

rts.FileName.exe survey

Replace "FileName" with the name of the executable you downloaded.

EXAMPLE  rts.win32.exe survey

  1. The survey utility will run. Once it completes, proceed to the Recovering and importing the survey results section of this article.

  1. From the command line, change your working directory to the executable's location and run the following command.

chmod +x rts.FileName.exe

Replace "FileName" with the name of the executable you downloaded.

EXAMPLE  chmod +x rts.linux32.exe

  1. Next, launch the installer as a super user. Replace all values in brackets with the values corresponding to your instance.

sudo ./rts.FileName.exe --survey

  1. The survey utility will run. Once it completes, proceed to the Recovering and importing the survey results section of this article.

Survey process for macOS X El Capitan through Mojave

  1. From the command line, change your working directory to the executable's location and run the following command.

sudo chmod +x rts.FileName.exe

Replace "FileName" with the name of the executable you downloaded.

EXAMPLE  chmod +x rts.macos.exe

  1. Launch the utility as a super user.

sudo ./rts.FileName.exe

  1. The survey utility will run. Once it completes, proceed to the Recovering and importing the survey results section of this article.

Survey process for macOS X Catalina through Monterey

  1. Rename the executable to rts.macos.exe.

  2. From the command line, change your working directory to the executable's location and run the following command.

  3. Run the following commands to make the utility executable and launch it.

cat rts.macos.exe > rts.macos-catalina.exe
chmod +x rts.macos-catalina.exe
sudo ./rts.macos-catalina.exe

  1. The survey utility will run. Once it completes, proceed to the Recovering and importing the survey results section of this article.

Recovering and importing the survey results

When the utility finishes running, it will generate a HostSurvey.tar file in one of the following locations:

  • If you ran the utility from the USB drive, you will find the file there.

  • If an end user ran the survey on your behalf, it will be in the same directory from which they ran the executable, and they can email it to you.

Once you have the file in hand, proceed to the Import the results section of this article to continue.

Next, you'll upload the resulting file to Datto EDR for processing. To do so, perform the following steps:

  1. From any system with connectivity to the internet, log in to your instance and navigate to Organizations.

  2. Select the organization to which the location belongs.

  3. Click the name of the location into which you'd like to import the survey. When possible, we recommend that you use the same location with which the offline endpoint is associated.

  4. From the action menu, click Upload Survey File.

  5. Drag and drop the HostSurvey.tar file into the Upload Survey File dialog. Then, click Upload Survey.

  6. Datto EDR will begin the import. The process may take some time to complete. Once it finishes, the results will appear in the Hosts view of the Analyze page. Any issues found will appear on the Alerts page.

Learn more

You can also use the Datto EDR API to export surveys. For more information, refer to Using the API to upload offline scans to the EDR cloud.