浮雲雅築: 2026

2026年9月3日星期四

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

2026-09-03

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

Client

https://docs.velociraptor.app/docs/deployment/clients/

執行velociraptor-v0.77.2-windows-amd64.msi (不是 .exe)，安裝畫面一閃而過，檢查發現安裝到C:\Program Files\Velociraptor 目錄

其中 client.config.yaml 內容


## Velociraptor client configuration. (0)
!!!

This file is an invalid client configuration that is included by the
Velociraptor install MSI.

You should replace this file with a valid configuration as created by
the Velociraptor configuration wizard.

If you installed the default Velociraptor MSI, this file will be
installed in "C:\Program files\Velociraptor\client.config.yaml".

However since the file is not valid, Velociraptor will refuse to start
until it is replaced with a valid file. You can replace the file after
installtion using group policy scheduled tasks.

Alternatively you can repack a valid configuration into the original
MSI, which will replace this file and allow the MSI to install a valid
configuration file. Use the following command line:

```
velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi
```


NOTE: We recommend you sign the MSI after repacking it. Repacking the
MSI will invalidate the signature!


Following is a sequence of space characters to pad out the Config file
allowing larger configuration files to be repacked.

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       ## Velociraptor client configuration (0x800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ## Velociraptor client configuration (0x1000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x1800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x2000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x2800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x3000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x3800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x4000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x4800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x5000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x5800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      # End

此檔案是 Velociraptor 安裝 MSI 中包含的無效客戶端設定檔。

您應該將此檔案替換為 Velociraptor 設定精靈建立的有效設定檔。

如果您安裝的是預設的 Velociraptor MSI，則此檔案將安裝在「C:\Program files\Velociraptor\client.config.yaml」中。

但是，由於此檔案無效，Velociraptor 將拒絕啟動，

直到將其替換為有效文件為止。您可以使用群組原則在安裝後安排一個任務來取代此檔案。

或者，您可以將有效的設定檔重新打包到原始 MSI 中，這將替換此文件，並允許 MSI 安裝有效的設定檔。

使用以下命令列：

velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi

注意：我們建議您在重新打包後對 MSI 進行簽名。重新打包 MSI 檔案會使簽章失效！

以下是一串空格，用於填充配置文件，

以便可以重新打包更大的設定檔。

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       ## Velociraptor client configuration (0x800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ## Velociraptor client configuration (0x1000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x1800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x2000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x2800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x3000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x3800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x4000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x4800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x5000)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   ## Velociraptor client configuration (0x5800)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      # End
C:\Program Files\Velociraptor>velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi
[INFO] 2026-09-03T08:50:52+08:00  _    __     __           _                  __
[INFO] 2026-09-03T08:50:52+08:00 | |  / /__  / /___  _____(_)________ _____  / /_____  _____
[INFO] 2026-09-03T08:50:52+08:00 | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/
[INFO] 2026-09-03T08:50:52+08:00 | |/ /  __/ / /_/ / /__/ / /  / /_/ / /_/ / /_/ /_/ / /
[INFO] 2026-09-03T08:50:52+08:00 |___/\___/_/\____/\___/_/_/   \__,_/ .___/\__/\____/_/
[INFO] 2026-09-03T08:50:52+08:00                                   /_/
[INFO] 2026-09-03T08:50:52+08:00 Digging deeper!                  https://www.velocidex.com
[INFO] 2026-09-03T08:50:52+08:00 This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609)
[INFO] 2026-09-03T08:50:52+08:00 Starting Org Manager service.
[INFO] 2026-09-03T08:50:52+08:00 Starting services for Org <root> (root)
[INFO] 2026-09-03T08:50:52+08:00 Starting Journal service for Org <root> (root).
[INFO] 2026-09-03T08:50:52+08:00 Starting user manager service for org root
[INFO] 2026-09-03T08:50:52+08:00 Starting the notification service for Org <root> (root).
[INFO] 2026-09-03T08:50:52+08:00 Installing Dummy inventory_service. Will download tools to temp directory.
[INFO] 2026-09-03T08:50:52+08:00 Starting repository manager for Org <root> (root)
[INFO] 2026-09-03T08:50:53+08:00 Loaded 421 built in artifacts in 155.7785ms
[ERROR] 2026-09-03T08:50:53+08:00 client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context
[
 {
  "RepackInfo": null
 }
][DEBUG] 2026-09-03T08:50:53+08:00 Query Stats: {"RowsScanned":1,"PluginsCalled":1,"FunctionsCalled":1,"ProtocolSearch":0,"ScopeCopy":3}
[INFO] 2026-09-03T08:50:53+08:00 Exiting notification service for Org <root> (root)!
velociraptor: error: config repack: client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context


C:\Program Files\Velociraptor>

ㄧ檢視說明

檢視client.config.yaml內容依舊。

失敗，待研究，待續

(待續)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法一 (失敗)

2026-09-02

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

velociraptor-v0.77.2-windows-amd64.exe

Client

https://docs.velociraptor.app/docs/deployment/clients/

檢視版本


C:\velociraptor>velociraptor.exe version
name: velociraptor
version: 0.77.2
commit: c0c9dd609
build_time: "2026-08-10T01:03:30Z"
compiler: go1.25.3
system: windows
architecture: amd64

C:\velociraptor>

檢視說明

C:\velociraptor>velociraptor.exe --help
usage: velociraptor [<flags>] <command> [<args> ...]

An advanced incident response and monitoring agent.

Flags:
  -h, --[no-]help                Show context-sensitive help (also try
                                 --help-long and --help-man).
      --remap=REMAP              A remapping configuration file for dead disk
                                 analysis.
      --[no-]nobanner            Suppress the Velociraptor banner
      --org=ORG                  Org ID to show
      --[no-]debug               Enables debug and profile server.
      --debug_port=6060          Port for the debug server.
  -c, --config=CONFIG            The configuration file.
      --embedded_config=EMBEDDED_CONFIG
                                 Extract the embedded configuration from this
                                 file.
  -a, --api_config=API_CONFIG    The API configuration file.
      --runas=RUNAS              Run as this username's ACLs
  -D, --definitions=DEFINITIONS  A directory containing artifact definitions
      --[no-]nocolor             Disable color output
  -v, --[no-]verbose             Enabled verbose logging.
      --profile=PROFILE          Write profiling information to this file.
      --profile_duration=PROFILE_DURATION
                                 Generate a profile file for each period in
                                 seconds.
      --trace=TRACE              Write trace information to this file.
      --[no-]trace_vql           Enable VQL tracing.
      --logfile=LOGFILE          Write to this file as well
      --tempdir=TEMPDIR          Write all temp files to this directory
      --mutant=MUTANT            When specified we use this mutant to ensure
                                 only one copy of the client is allowed to run.
      --[no-]prompt              Present a prompt before exit
      --max_wait=10              Maximum time to queue results.
      --timezone=TIMEZONE        Default encoding timezone (e.g.
                                 Australia/Brisbane). If not set we use UTC
  -r, --run=RUN                  Run an artifact as a CLI tool.

Commands:
  help [<command>...]
  artifacts
    list [<flags>] [<regex>]
    show <name>
    collect [<flags>] <artifact_name>...
    fetch --flow_id=FLOW_ID --output=OUTPUT [<flags>]
    reformat [<flags>] <paths>...
    verify [<flags>] <paths>...
  client [<flags>]
  config
    show [<flags>]
    client
    api_client --name=NAME [<flags>] <output>
    generate [<flags>]
    rotate_keys [<flags>]
    reissue_certs [<flags>]
    frontend
    repack [<flags>] <config_file> <output>
  csv [<flags>] <files>...
  deaddisk [<flags>] <output>
  debian [<flags>]
    server [<flags>]
    client [<flags>]
  frontend [<flags>]
  fs [<flags>]
    ls [<path>]
    cp <path> <dumpdir>
    cat <path>
    zcat <chunk_path> <file_path>
    rm <path>
  golden [<flags>] <directory>
  acl
    show [<flags>] <principal>
    grant [<flags>] <principal> [<policy>]
  gui [<flags>]
  hunts
    reconstruct
  service [<flags>]
    install
    remove
    start
    stop
    pause
    continue
  collector [<flags>] [<spec_file>]
  decrypt [<flags>] <collection> [<output>]
  pool_client [<flags>]
  query [<flags>] <queries>...
  rpm [<flags>]
    client [<flags>]
    server [<flags>]
  server_service
    install
    remove
    start
    stop
    pause
    continue
  tools
    show [<file>]
    rm <name>
    upload --name=NAME [<flags>] [<path>]
  unzip [<flags>] <file> [<members>]
  user
    add --role=ROLE <username> [<password>]
    show [<flags>] <username>
  version
  vql
    list
    export [<old_file>]


C:\velociraptor>

產生設定檔 (Enter 表示選擇)


cd C:\Velociraptor

velociraptor.exe config generate -i

下圖，設定帳號、密碼　

下圖，沒有其他帳號、密碼，可以直接Enter通過

下圖，如果要修改設定檔案


version:
  name: velociraptor
  version: 0.77.2
  commit: c0c9dd609
  build_time: "2026-08-10T01:03:30Z"
  compiler: go1.25.3
  system: windows
  architecture: amd64
Client:
  server_urls:
  - https://localhost:8000/
  ca_certificate: |
    -----BEGIN CERTIFICATE-----
    MIIDTDCCAjSgAwIBAgIRALrEXWp8RVj4E+luaSFVZVQwDQYJKoZIhvcNAQELBQAw
    GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2
    MDgzMDAyNDg1NFowGjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMIIBIjANBgkq
    hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/
    7xWzzAMwzMU1kpmuqtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf
    2NvHeONjmjWFhWPmoNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32
    U52OX8+pu+PWHe8IhsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7
    tJ86U+SaxOPRLQoIKvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSu
    z10IZ4Szp1EZZrjB1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABo4GM
    MIGJMA4GA1UdDwEB/wQEAwICpDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUH
    AwIwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUVYkRz7YxTckKWP8KJuDHgoMP
    zVAwKAYDVR0RBCEwH4IdVmVsb2NpcmFwdG9yX2NhLnZlbG9jaWRleC5jb20wDQYJ
    KoZIhvcNAQELBQADggEBAKcI9Pop70xRpzu2v9Hi5hQdSGQEAGqqXwjuVUrzlF6W
    Z+uFfFn5x4zOTU1tzxRG0a3uyePbPTGAJs0Jp4v/w7VX+pXs2H87k2ohBtdsAKGY
    ZWYMmReNURtNdm22Lo9h7nZ4C5v7Y/S00D3u1PxpQV4dYBbDA+4MgGV0SGqppMdi
    aldMPxyrfVk8PyuAZJq/rIPz4FGWKmf6dVqlKzmkcuRvtCrhv1sMyLVmn2z0QFK/
    pIsfgRmF0LEMh1Vn3ouDZXsp7jTRjpyibSB2S2UTDKINXsmuDAk71iD0YWfEMuRL
    Prwgj5rwrY+smEUz+d/ElznxRAGqcl5O+kUxc3oim2k=
    -----END CERTIFICATE-----
  nonce: X67UA31K0vY=
  writeback_darwin: /etc/velociraptor.writeback.yaml
  writeback_linux: /etc/velociraptor.writeback.yaml
  writeback_windows: $ProgramFiles\Velociraptor\velociraptor.writeback.yaml
  level2_writeback_suffix: .bak
  tempdir_windows: $ProgramFiles\Velociraptor\Tools
  max_poll: 60
  nanny_max_connection_delay: 600
  windows_installer:
    service_name: Velociraptor
    install_path: $ProgramFiles\Velociraptor\Velociraptor.exe
    service_description: Velociraptor service
  darwin_installer:
    service_name: com.velocidex.velociraptor
    install_path: /usr/local/bin/velociraptor
  server_version:
    version: 0.77.2
    commit: c0c9dd609
    build_time: "2026-08-10T01:03:30Z"
  use_self_signed_ssl: true
  max_upload_size: 5242880
  local_buffer:
    memory_size: 52428800
    disk_size: 1073741824
    filename_linux: /var/tmp/Velociraptor_Buffer.bin
    filename_windows: $TEMP/Velociraptor_Buffer.bin
    filename_darwin: /var/tmp/Velociraptor_Buffer.bin
API:
  bind_address: 127.0.0.1
  bind_port: 8001
  bind_scheme: tcp
GUI:
  bind_address: 127.0.0.1
  bind_port: 8889
  gw_certificate: |
    -----BEGIN CERTIFICATE-----
    MIIDQjCCAiqgAwIBAgIRAIDS/dSpcucP88AV4qgKP+gwDQYJKoZIhvcNAQELBQAw
    GjEYMBYGA1UEChMPVmVsb2NpcmFwdG9yIENBMB4XDTI2MDkwMjAyNDg1NFoXDTM2
    MDgzMDAyNDg1NFowKTEVMBMGA1UEChMMVmVsb2NpcmFwdG9yMRAwDgYDVQQDDAdH
    UlBDX0dXMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1UXYPvIsQsrL
    6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM/E1MTnRMj9GVzRjjsumOosZvbkyU
    tW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYML9JOgC8Qs+/W+iuR4X4zXJOSoNzv
    4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiHOSLaF+EAgj9yJqFDld9PoRr16LoS
    dAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vWpyCdEbtDqn4Puenn9dcJPlBVb2i9
    YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0SJrIZzEkg+J3VAD8luIU2UpHBmyW
    uldoHiJtQwIDAQABo3QwcjAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB
    BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUVYkRz7Yx
    TckKWP8KJuDHgoMPzVAwEgYDVR0RBAswCYIHR1JQQ19HVzANBgkqhkiG9w0BAQsF
    AAOCAQEAYpXqwuJZFxAy1jiZvg05bdw753+vj/B/xCu5NH0UwTIjcMeHyaG4f8x4
    NNhPiRVvGkQkxWavHDHQ3B9zc4cOIeBaGhLf1N3TPzy+uHXga/azDxAHCa+El68n
    2N1wjtiVU7VA/nHUDTwlS2ZaVYY9sktAAfsQTxxP2k2gtggC7Erajk21HmmQAcyH
    59V4xfvaSX0tQlWtkTuUcwAnAOiQPJsqDj/jSLDj3orzEt2GLvt5PYwtgS+GwCUS
    P8nCgeMy+rBPD3ZzRfzmx7oteZaHszU0eHmzAPLiKtLk6oh3rXRA2J2V8GG8N3aC
    kinJsVtlbjDxvPP65v3n18kTDAfT8A==
    -----END CERTIFICATE-----
  gw_private_key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEogIBAAKCAQEA1UXYPvIsQsrL6L4ME/kYaUX5XaBqjMil8i1aBK0U8Aw9ErCM
    /E1MTnRMj9GVzRjjsumOosZvbkyUtW5dOBqtuaN/2c0aISe0YQwlUY/tAHO2NOYM
    L9JOgC8Qs+/W+iuR4X4zXJOSoNzv4m86IfGpFH61v/O8kJTCYEkcSHJYZeybQhiH
    OSLaF+EAgj9yJqFDld9PoRr16LoSdAKIymazzs0hhYP69FAaBxzzQAk65sMXQ7vW
    pyCdEbtDqn4Puenn9dcJPlBVb2i9YbQILi/gWU9jFju6tTeT/qUTGsKMrEiTB3g0
    SJrIZzEkg+J3VAD8luIU2UpHBmyWuldoHiJtQwIDAQABAoIBAEqu3iZQvKIZDOWw
    I1+dI2i9+bBJG/a3zrCrI/IuP/49cueIDp7NXLK+dA8KyAfdtuKweePTVDMOOyb7
    gkZCxWIT+JHnCkbg9f/j9m+E1GwLmRsWEd9vKFEn6hPwoVnShw+tF0RMYxTUuWYU
    KAm568kDBBc3PWltxlFcWLyf2ge6euDmiF+6901kZA/r2lhxIUuHgUAGRF8l20ke
    fPxQvI42C67FRFdnolWOQ5zqJnimX6fq3AyHfnfVf47nCqjNEQJslvTA1cZCu68b
    KHyDT97oJ2eVzjCcpTgpxcd2Qb6uWqAntaSBeyyKXqEU4mjebIBcHhFu2CYe17iY
    u6dl6B0CgYEA3tjene4Yn68HDGzoIxm6dGXQLIfDSuVAYtZps/zpw5UaiVRmSf8v
    WwQ/wyikvpw6WKML+PjVmg6p1t9ryKmXHgKIjd39Afmt8SsJrvt+JlADUQj4hDSE
    8HLyDv+HSK13ou3oInAp83CxEeUJSqukn1AHiOGiBP5ho6l+W1PQWg8CgYEA9QBW
    YZW9nw/jgKjr82dfuHPEJR4iICK8BmxsS0aZpaN3r79eqAJloAmUA+Yt+9sFJBbz
    ixMCp8WtY4e6XWuEmnJ/4JYwe7j3RlbnqROYt/nNfIuUH0G8VCtcHqtRvY/9qP+N
    I2JacpCmVQ3g9e8w3JFsTawSi/d3dfbHgB6g/Y0CgYBgO4ze7GvLwVys2/be+YRQ
    MYtVP4dxN1C3ndnltOkJ4cCk30KQ39cGWe5jC5EhEvwLPNW1vVcYgQ6M0MyNydaN
    ShDIGr3gdX7M74Xt/4K5bsIP42zWQovJ/glTurskAmzwegZNoNws2VRN4vdBPKAJ
    gBjQ3ocF2wg1EcOUErydtwKBgCFq0V1wGjQW67YB1GUXxYOYLrnNWWQ+uJy7ry25
    TH2+RTXwiU2rPgdNJyY9ACqpHhNlGgTvK96MZPD9c1sIrkaOtYiBk81cVkX+1oxG
    Qv9dED0boLF+utxUKbV5MqYDfNrPOIYKBUI5HqbdRMDmxihfoYEaplD3CRFK/r0n
    8FeFAoGAdl3Nq9QVT0B+xAfovXm0fs1lDCvhKupEVfmByLYMTnLFCLFo3oKo2hxd
    b9OfUb7IeZnvXvbPc3vBzbZeYRqePW7CLWc4y5ft2A+SHcNmJCv/67Cppz3wP03s
    uIJ/hkNQFaThzHETQcTjL5WZCU38YA2kmdss3nhCumM7zLRti+g=
    -----END RSA PRIVATE KEY-----
  public_url: https://localhost:8889/app/index.html
  links:
  - text: Documentation
    url: https://docs.velociraptor.app/
    icon_url: data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI1MyIgaGVpZ2h0PSI2MyIgdmVyc2lvbj0iMS4xIiB2aWV3Qm94PSIwIDAgNTMgNjMiPjxwYXRoIGQ9Ik0yNyAzYy0zIDItMTMgOC0yMyAxMGw2IDMyYTEwMyAxMDMgMCAwIDAgMTcgMTZsNi01IDExLTExIDYtMzJDMzkgMTEgMzAgNSAyNyAzeiIgZmlsbD0iI2ZmZiIgZmlsbC1ydWxlPSJldmVub2RkIi8+PHBhdGggZD0iTTI2IDBDMjMgMiAxMiA4IDAgMTBjMSA3IDUgMzIgNyAzNWExMTMgMTEzIDAgMCAwIDE5IDE4bDctNiAxMi0xMmMyLTMgNi0yOCA4LTM1QzQwIDggMjkgMiAyNiAwWm0wIDU1LTYtNC04LTktNS0yNnYtMWwyLTFjOC0xIDE2LTYgMTYtNmwxLTEgMSAxczggNSAxNyA2bDEgMXYxcy0zIDIzLTUgMjZsLTggOWMtMiAyLTQgNC02IDR6IiBmaWxsPSIjYWIwMDAwIiBmaWxsLW9wYWNpdHk9IjEiIGZpbGwtcnVsZT0iZXZlbm9kZCIvPjxwYXRoIGQ9Ik0zOSAxOWExMzQ3IDEzNDcgMCAwIDEtMTMgMjZoLTJMMTQgMTloM2wyIDEgMSAxdjFhMjUwIDI1MCAwIDAgMSA2IDE3IDUyODkgNTI4OSAwIDAgMCA5LTIwaDR6IiBmaWxsPSIjMDAwIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiIHN0cm9rZT0iIzAwMCIgc3Ryb2tlLWRhc2hhcnJheT0ibm9uZSIgc3Ryb2tlLWxpbmVjYXA9ImJ1dHQiIHN0cm9rZS1saW5lam9pbj0ibWl0ZXIiIHN0cm9rZS13aWR0aD0iMSIvPjwvc3ZnPg==
    type: sidebar
    new_tab: true
  initial_users:
  - name: admin
    password_hash: cc13df84c2dd35e9b409138cb8912c8bf0bc3b4eda7fda11fdb08c60a7f134e7
    password_salt: 518645ed9359fee7b2ba5484406bda0d81f7b8be0c0fe075d19a7b5b757ef5a5
  authenticator:
    type: Basic
CA:
  private_key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEA5OhVcgFUtkH3DLhdNQQQfIk854xl6OY/7xWzzAMwzMU1kpmu
    qtJO0WBvR48Y1QZ4d7Me5KR/75HiN+Hx+zDk6SBGX5IZLYNf2NvHeONjmjWFhWPm
    oNj6KT2uN5F5mIjLmA8ujY9ySkl1E3E/mZmsIyq9mbsxio32U52OX8+pu+PWHe8I
    hsvUjR73RgRIcuWl9IrgvWv4MXJwPJuGty0tMlowHUczlMw7tJ86U+SaxOPRLQoI
    KvbjgjjSv/7YMysb4g24X4DRYaACKvJzGX2LuM69DuojOoSuz10IZ4Szp1EZZrjB
    1JxyLksXgtcYUAv1+waRGGdJu3xZRi1Q5BYcbQIDAQABAoIBACeywlTL9crI/GUk
    mSePXaOXcmxOvULLobVfTGf6eq1cmzqiM/hUkk49/PaKUtpo7Z4GvroU7EoaQQMD
    iKGRXHWwvvumnP63bLkxfnHQ765oD1Cvn2jwUEw0MgFZlZ62RKbJpT9wK/hFrovx
    ZUAIdmG/8RNW81PN5HUiWzVzEILwv7Fi4aCBnsHOW0T0TBee33sHL3w8PH2fQ0XS
    EeWJuLTEOATkk6UIHXpFWRtvhMRgvUFxh1Y90XBxhIJrA+t4Qonwcal+MCHz91sB
    atn2Yhjhb23HjlobRSif9kJPpaLmzvxBf7ZcG6pDSKSC+jCcu4lTWjSB3jYKOCen
    S78ZTkECgYEA7ooEqY0PF5rKeTXthvUzs+VV0N+0Kdc0za3jFjmD7+XnMZs6Q7dm
    jjXx9ZSYFyxLtVF5TPQrh4dWSPdGYjvaoUC2HSLXeKq1v/Az6V2RLcmwtW3IKbAh
    8CvmgjeUcpTmmvA3M0Z9zpKcmOuu+T39Qdk113OEonzAGNoU7QABci0CgYEA9anU
    Wop2zSST/yJZO9p7k5AfyydCRZAeHYNa6PfiRoctFFei05KOU81M1HiPXaPg4siq
    x4dKfaoDnwIx88deTvaeJJ9TJpWoDHRaowrTFpbuIyBL/uADS0eRmbQgkaZXpOSJ
    BjL+DV2vnI6vYMDqyq1Xce0BRP4duYTMo6We+0ECgYEAtifTU56STdY4k8MotYx9
    hPy2QaDytZjPi9kjto8JP6Lyn6EIJzngKOzs7jogwmFjFv02ghtbOk2RCHs71jwa
    wlTmPO2kWVMTI5VMLwLyoGKKfKFu3tbPs9XyWrISvEUUrHCP1qoX3C19RBGGNnKt
    +SDjyrk+Kc7V6qRuomUEtakCgYA2IbL6NHKTJ5E48e+pwa3jSSnIUSFIRMZuCGi6
    1wxUMCsdxWXKqwuTqbRZSSuGHbtLHZ6MEuK2KAVeP1SUfATq72rPdRAUe3upKuZh
    8NusqZtVwCMeyWvQZbfOn6NhlL7RRc5vwEK83Tz6CXLZpgjWmjWfk/LoqfoQzBNv
    p+oNQQKBgQDYHvucRGrTG6DQtfYNhl2LUKhmwKM0aSDF2NB2rrUtwnNg5jor/WIE
    7cH9rg9FuBvF6Xfy3BKXB0VpX9csEzdEVHrFWPlfJpyHfmpmM1ANoUDPVPma3S/b
    hizBK1RnyseirVelx5cl2ZhPM1W9Y6vhTCJQYnhhP4tQHaWEVi7PoQ==
    -----END RSA PRIVATE KEY-----
Frontend:
  hostname: localhost
  bind_address: 0.0.0.0
  bind_port: 8000
  certificate: |
    -----BEGIN CERTIFICATE-----
    MIIDVzCCAj+gAwIBAgIQUNs2ryX1dxf3TmfZ79AT8jANBgkqhkiG9w0BAQsFADAa
    MRgwFgYDVQQKEw9WZWxvY2lyYXB0b3IgQ0EwHhcNMjYwOTAyMDI0ODU0WhcNMzYw
    ODMwMDI0ODU0WjA0MRUwEwYDVQQKEwxWZWxvY2lyYXB0b3IxGzAZBgNVBAMTElZl
    bG9jaXJhcHRvclNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
    APyL4VOSOSWOtVNp76efcnOQC93MlV8LWENXTg7EI4Q+61dDymy9+YVSKJBnezgj
    WOIiyGWPChzFQTF16ykT0vE/sdAoauD5v2AQPuGjHSNJ2HxeoHmvvBni3P8RW6Z0
    sXWsr7I3oL4NKVLElECYFC+MEYaEm83WoRrVl/ouFLxO/L3RneeZrJtoPYLYKgLT
    m3KdaEYhtvAermlkEm9o+smWrtb6BRrF+Ev9RrBr8eZSFRrNffFYBbFrKjVgZTV5
    pfpaa6Ztt6O3xpBZu0SLb4Igs//yWFn9oboPYH+3UeyRngiwfEu3GY7LlltQVz/v
    pcw4oISOlHWyRAb8G1VB8WECAwEAAaN/MH0wDgYDVR0PAQH/BAQDAgWgMB0GA1Ud
    JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQY
    MBaAFFWJEc+2MU3JClj/Cibgx4KDD81QMB0GA1UdEQQWMBSCElZlbG9jaXJhcHRv
    clNlcnZlcjANBgkqhkiG9w0BAQsFAAOCAQEAleTJ8HHlvTepfigdqKKE79agfZWT
    Lrjyc0qkOoHBKTBibRaquPR8FRw5mynh5uM6m54ga+EpBCXRId0pnUOy7IlxJzX4
    IWnA3ThzH5XkdY89PGlyXXaLLKBtr9toHHyx0hnObLviyIC2sPpjk/04SEtuzpq5
    Fv7HZgQZqeum0sTS7O+X7p+EoBEElxqDUI207L7vvzR9qMRBwazPuq/svbQ0vWJL
    HWOvHxxJqVE/876x3XOduX/c5XtBrEPSf1TKEyidP2WxuaS37VGMtmYVH1m/gDK8
    odEm5xDVCE1nXN9i88Jvm4BJOrLNZZDP9y8MrcR7aXyS94Tp6/sRPgVOhQ==
    -----END CERTIFICATE-----
  private_key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpAIBAAKCAQEA/IvhU5I5JY61U2nvp59yc5AL3cyVXwtYQ1dODsQjhD7rV0PK
    bL35hVIokGd7OCNY4iLIZY8KHMVBMXXrKRPS8T+x0Chq4Pm/YBA+4aMdI0nYfF6g
    ea+8GeLc/xFbpnSxdayvsjegvg0pUsSUQJgUL4wRhoSbzdahGtWX+i4UvE78vdGd
    55msm2g9gtgqAtObcp1oRiG28B6uaWQSb2j6yZau1voFGsX4S/1GsGvx5lIVGs19
    8VgFsWsqNWBlNXml+lprpm23o7fGkFm7RItvgiCz//JYWf2hug9gf7dR7JGeCLB8
    S7cZjsuWW1BXP++lzDighI6UdbJEBvwbVUHxYQIDAQABAoIBAAeD7VLtm28VOIBt
    f0jqGrklZKHO0Wwxcl4HL3sTaUmP7LRsO1sWIg0KSP69xqt4VhRlvetTgwxTmVaG
    Q6xO/2G+PX8uTDIQHrRamHnIWLj3LgHs738zzh5ka+dyMbl8G4LBGCSZbIUmAHOb
    05N12YLc+wKqcfobFJbrcNGwtaHKwNFYSF7boE1PT0iWSRbcdMjm0MUI7jw3ugPO
    RLKeStO4NTx5vf0kyaLfLT6CN5fLNjLt1FJA81yZ6N9/Ht/wj18u1eQlMTrGvrQM
    hrki24BRzoTxPDuLH5Wcyddb2qsi0yTgDTzcVShuHRJyjs8VIU4Rf+QFFWz52Sks
    VKE6ZOkCgYEA/t3W77yTxKRW+FSHLUiIdZ6lRnHt1PNjP1y8MeeY4k7mkHnZBWZW
    yQuKBitBFkYx05iD1hJJ8R51ND/D7kW+qEWqtIthlozBddHFWdvw5tQU9izhis0H
    QSaT6NxDFsqUDFhzRqQeQd3gPy0qeDw3EBVwRuzbxTZSTBvko1tJRh8CgYEA/atm
    LeMXPP0oFbY9cfHege/rc5CY5Pgm1G3gZQIkwUiIH7WPW3S2itlK3Cc30D9x663C
    ODdFxPJjoGaRtGdlHLfGRjHeHIIhKIajxLBGwZlYL0LHADQwnY+irFoyNdb5VPYW
    9AIEAQ2MICsQTSqDYXiZDDoystWMfiVsFMOC2H8CgYBBu+e+x215T0WbIPoIZOfF
    JljMVYAY53lWk016tZgJ7n2rD7I4oU+K5O4Bb1CHNS2OvIxsPyVRCiECi9u17ckh
    z24ayMQvtzgCcksrRP3aGyMY5zR4vy66z/9gFMc87pzGnl2E/7lKFbbLtJN6lVVC
    UbU2pcp9D+ij9qG+vEGm0wKBgQDis+2LkOpRvUW3sbjUPn7GzW41R8L8zrGVI+Vp
    IDNM8c+F1zMZXwNMr8lxWzNMT4c2Q4HRz8PwsVdMIJ6TBdydf7gZP7Pq8nlDyKBP
    xeJWXv8qrZk/m2TfS2Dse2doKomF3rDAvZRqhHr4vMPC0v27fJX7EYABx0vZ6QPg
    wqILbQKBgQCgdFhfm8eFnqA+yevabQXKXCSKlUCjOpPuXSEz66YpPqSjQiMCzsHr
    qDs1QhLZNcNC/pPTeZhnDDRLqu8lrgorZrbKvMEynqrkcad9H0thesZXbQREmBbZ
    X3jH3s8OwzF7wXxApHRvl/e4LoDDM/HixLvd0ibWmod4e2zT1PgJSQ==
    -----END RSA PRIVATE KEY-----
  default_client_monitoring_artifacts:
  - Generic.Client.Stats
  GRPC_pool_max_size: 100
  GRPC_pool_max_wait: 60
  resources:
    connections_per_second: 100
    notifications_per_second: 30
    max_upload_size: 104857600
    expected_clients: 30000
Datastore:
  implementation: FileBaseDataStore
  location: /opt/velociraptor
  filestore_directory: /opt/velociraptor
  compression: zlib
Logging:
  output_directory: /opt/velociraptor/logs
  separate_logs_per_component: true
  debug:
    disabled: true
  info:
    rotation_time: 604800
    max_age: 31536000
  error:
    rotation_time: 604800
    max_age: 31536000
Monitoring:
  bind_address: 127.0.0.1
  bind_port: 8003
api_config: {}
obfuscation_nonce: J0Vrd60ffVE=
defaults:
  hunt_expiry_hours: 168
  notebook_cell_timeout_min: 10
security:
  certificate_validity_days: 3650

如果你要讓其他電腦的 Agent 連進來


Frontend:
  bind_address: 127.0.0.1

需要改成：


Frontend:
  bind_address: 0.0.0.0

GUI 也要允許遠端


GUI:
  bind_address: 127.0.0.1

需要改成：


GUI:
  bind_address: 0.0.0.0

測試設定檔案


cd /d C:\Velociraptor

velociraptor.exe --config server.config.yaml frontend -v

結果


C:\velociraptor>velociraptor.exe --config server.config.yaml frontend -v
[INFO] 2026-09-02T03:01:04Z  _    __     __           _                  __
[INFO] 2026-09-02T03:01:04Z | |  / /__  / /___  _____(_)________ _____  / /_____  _____
[INFO] 2026-09-02T03:01:04Z | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/
[INFO] 2026-09-02T03:01:04Z | |/ /  __/ / /_/ / /__/ / /  / /_/ / /_/ / /_/ /_/ / /
[INFO] 2026-09-02T03:01:04Z |___/\___/_/\____/\___/_/_/   \__,_/ .___/\__/\____/_/
[INFO] 2026-09-02T03:01:04Z                                   /_/
[INFO] 2026-09-02T03:01:04Z Digging deeper!                  https://www.velocidex.com
[INFO] 2026-09-02T03:01:04Z This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609)
[INFO] 2026-09-02T03:01:04Z Loading config from file server.config.yaml
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorFrontend
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorClient
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorGUI
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\Velociraptor
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAPI
[INFO] 2026-09-02T03:01:04Z Initializing logging for \opt\velociraptor\logs\VelociraptorAudit
[INFO] 2026-09-02T03:01:04Z Starting Frontend. {"build_time":"2026-08-10T01:03:30Z","commit":"c0c9dd609","version":"0.77.2"}
[ERROR] 2026-09-02T03:01:04Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp
[INFO] 2026-09-02T03:01:04Z Setting temp directory to C:\Users\ADMINI~1\AppData\Local\Temp
[INFO] 2026-09-02T03:01:04Z Starting Org Manager service.
[INFO] 2026-09-02T03:01:04Z Starting services for Org <root> (root)
[INFO] 2026-09-02T03:01:04Z Frontend: Server will be master.
[INFO] 2026-09-02T03:01:04Z Starting Backup Services for Org <root> (root) every 24h0m0s
[INFO] 2026-09-02T03:01:04Z Filestore implementation FileBaseDataStore.
[INFO] 2026-09-02T03:01:04Z Starting Journal service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z Starting user manager service for org root
[INFO] 2026-09-02T03:01:04Z UserManagerService: Watching for events from Server.Internal.UserManager
[INFO] 2026-09-02T03:01:04Z Starting Server Scheduler Service
[INFO] 2026-09-02T03:01:04Z Starting the notification service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Ping
[INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Pong
[INFO] 2026-09-02T03:01:04Z NotificationService: Watching for events from Server.Internal.Notifications
[INFO] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilding snapshot for org Org <root> (root) from legacy records - this might take a while.
[DEBUG] 2026-09-02T03:01:04Z ClientInfo Manager Rebuilt 0 clients from Legacy data.
[INFO] 2026-09-02T03:01:04Z Starting Client Info service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientTasks
[INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientScheduled
[INFO] 2026-09-02T03:01:04Z ClientInfoManager: Watching for events from Server.Internal.ClientPing
[INFO] 2026-09-02T03:01:04Z InventoryService: Watching for events from Server.Internal.Inventory
[INFO] 2026-09-02T03:01:04Z Starting Inventory Service for Org <root> (root)
[INFO] 2026-09-02T03:01:04Z InventoryService: Reloading inventory from file for org root
[INFO] 2026-09-02T03:01:04Z Starting repository manager for Org <root> (root)
[INFO] 2026-09-02T03:01:04Z RepositoryManager: Watching for events from Server.Internal.ArtifactModification
[INFO] 2026-09-02T03:01:04Z Loaded 421 built in artifacts in 119.298ms
[INFO] 2026-09-02T03:01:04Z Loaded 0 custom artifacts in 0s
[WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one.
[INFO] 2026-09-02T03:01:04Z Starting hunt manager service for Org <root> (root) with rate limit 30/s.
[WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one.
[INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.HuntModification
[WARNING] 2026-09-02T11:01:04+08:00 Unable to store inventory - will run with an in memory one.
[INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Hunt.Participation
[INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Label
[INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from Server.Internal.Interrogation
[INFO] 2026-09-02T03:01:04Z HuntManager: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z Starting Enrollment service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z InterrogationService for Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z InterrogationService for Custom.Generic.Client.Info/BasicInformation: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z InterrogationService: Watching for events from Server.Internal.Enrollment
[INFO] 2026-09-02T03:01:04Z HuntDispatcher: Watching for events from Server.Internal.HuntUpdate
[INFO] 2026-09-02T03:01:04Z Starting Hunt Dispatcher Service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z Starting Indexing Service for Org <root> (root). Refreshing every 5m0s
[DEBUG] 2026-09-02T03:01:04Z Indexing service search index loaded 0 items in 0s
[INFO] 2026-09-02T03:01:04Z Starting VFS writing service for Org <root> (root).
[INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.ListDirectory/Stats: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z VFSService for System.VFS.DownloadFile: Watching for events from System.Flow.Completion
[INFO] 2026-09-02T03:01:04Z Labeler: Watching for events from Server.Internal.Label
[INFO] 2026-09-02T03:01:04Z Starting Server Artifact Runner Service for Org <root> (root)
[INFO] 2026-09-02T03:01:04Z Starting Label service.
[INFO] 2026-09-02T03:01:04Z NotebookWorker:  Connecting to master scheduler with worker local_notebook_1
[INFO] 2026-09-02T03:01:04Z NotebookWorker:  Connecting to master scheduler with worker local_notebook_0
[INFO] 2026-09-02T03:01:04Z NotebookWorker:  Connecting to master scheduler with worker local_notebook_2
[INFO] 2026-09-02T03:01:04Z NotebookWorker:  Connecting to master scheduler with worker local_notebook_3
[INFO] 2026-09-02T03:01:04Z NotebookWorker:  Connecting to master scheduler with worker local_notebook_4
[DEBUG] 2026-09-02T03:01:04Z Reloading client monitoring tables from datastore
[INFO] 2026-09-02T03:01:04Z Starting Client Monitoring Service for Org <root> (root)
[INFO] 2026-09-02T03:01:04Z Creating default Client Monitoring Service
[INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.ArtifactModification
[INFO] 2026-09-02T03:01:04Z client_monitoring_service: Watching for events from Server.Internal.MetadataModifications
[DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0}
[DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0}
[DEBUG] 2026-09-02T03:01:04Z Query Stats: {"RowsScanned":0,"PluginsCalled":0,"FunctionsCalled":0,"ProtocolSearch":0,"ScopeCopy":0}
[INFO] 2026-09-02T03:01:04Z Exiting notification service for Org <root> (root)!
[INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.DownloadFile for Org <root> (root) (VFSService)
[INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory for Org <root> (root) (VFSService)
[INFO] 2026-09-02T03:01:04Z Stopping watch for System.VFS.ListDirectory/Stats for Org <root> (root) (VFSService)
velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified.

C:\velociraptor>

執行


velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend


C:\velociraptor>velociraptor.exe --config C:\Velociraptor\server.config.yaml frontend
[ERROR] 2026-09-02T03:03:15Z Unable to write to configured temp dir C:\Program Files\Velociraptor\Tools - falling back to C:\Users\ADMINI~1\AppData\Local\Temp
velociraptor.exe: error: frontend: starting frontend: mkdir \\?\\opt: The system cannot find the file specified.

C:\velociraptor>

失敗，待續

(待續)