[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

[研究]velociraptor 0.77.2(迅猛龍) Server (Windows Server 2019) 架設方法二(失敗)

2026-09-03

https://github.com/Velocidex/velociraptor/releases

2026-08-10釋出0.77.2版，目前最新版

https://github.com/Velocidex/velociraptor/releases/tag/v0.77.2

Client

https://docs.velociraptor.app/docs/deployment/clients/

執行velociraptor-v0.77.2-windows-amd64.msi (不是 .exe)，安裝畫面一閃而過，檢查發現安裝到C:\Program Files\Velociraptor 目錄

其中 client.config.yaml 內容

## Velociraptor client configuration. (0) !!! This file is an invalid client configuration that is included by the Velociraptor install MSI. You should replace this file with a valid configuration as created by the Velociraptor configuration wizard. If you installed the default Velociraptor MSI, this file will be installed in "C:\Program files\Velociraptor\client.config.yaml". However since the file is not valid, Velociraptor will refuse to start until it is replaced with a valid file. You can replace the file after installtion using group policy scheduled tasks. Alternatively you can repack a valid configuration into the original MSI, which will replace this file and allow the MSI to install a valid configuration file. Use the following command line: ``` velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi ``` NOTE: We recommend you sign the MSI after repacking it. Repacking the MSI will invalidate the signature! Following is a sequence of space characters to pad out the Config file allowing larger configuration files to be repacked. ## Velociraptor client configuration (0x800) ## Velociraptor client configuration (0x1000) ## Velociraptor client configuration (0x1800) ## Velociraptor client configuration (0x2000) ## Velociraptor client configuration (0x2800) ## Velociraptor client configuration (0x3000) ## Velociraptor client configuration (0x3800) ## Velociraptor client configuration (0x4000) ## Velociraptor client configuration (0x4800) ## Velociraptor client configuration (0x5000) ## Velociraptor client configuration (0x5800) # End

此檔案是 Velociraptor 安裝 MSI 中包含的無效客戶端設定檔。

您應該將此檔案替換為 Velociraptor 設定精靈建立的有效設定檔。

如果您安裝的是預設的 Velociraptor MSI，則此檔案將安裝在「C:\Program files\Velociraptor\client.config.yaml」中。

但是，由於此檔案無效，Velociraptor 將拒絕啟動，

直到將其替換為有效文件為止。您可以使用群組原則在安裝後安排一個任務來取代此檔案。

或者，您可以將有效的設定檔重新打包到原始 MSI 中，這將替換此文件，並允許 MSI 安裝有效的設定檔。

使用以下命令列：

velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi

注意：我們建議您在重新打包後對 MSI 進行簽名。重新打包 MSI 檔案會使簽章失效！

以下是一串空格，用於填充配置文件，

以便可以重新打包更大的設定檔。

## Velociraptor client configuration (0x800) ## Velociraptor client configuration (0x1000) ## Velociraptor client configuration (0x1800) ## Velociraptor client configuration (0x2000) ## Velociraptor client configuration (0x2800) ## Velociraptor client configuration (0x3000) ## Velociraptor client configuration (0x3800) ## Velociraptor client configuration (0x4000) ## Velociraptor client configuration (0x4800) ## Velociraptor client configuration (0x5000) ## Velociraptor client configuration (0x5800) # End C:\Program Files\Velociraptor>velociraptor config repack --msi velociraptor-windows.msi client.config.yaml output.msi [INFO] 2026-09-03T08:50:52+08:00 _ __ __ _ __ [INFO] 2026-09-03T08:50:52+08:00 | | / /__ / /___ _____(_)________ _____ / /_____ _____ [INFO] 2026-09-03T08:50:52+08:00 | | / / _ \/ / __ \/ ___/ / ___/ __ `/ __ \/ __/ __ \/ ___/ [INFO] 2026-09-03T08:50:52+08:00 | |/ / __/ / /_/ / /__/ / / / /_/ / /_/ / /_/ /_/ / / [INFO] 2026-09-03T08:50:52+08:00 |___/\___/_/\____/\___/_/_/ \__,_/ .___/\__/\____/_/ [INFO] 2026-09-03T08:50:52+08:00 /_/ [INFO] 2026-09-03T08:50:52+08:00 Digging deeper! https://www.velocidex.com [INFO] 2026-09-03T08:50:52+08:00 This is Velociraptor 0.77.2 built on 2026-08-10T01:03:30Z (c0c9dd609) [INFO] 2026-09-03T08:50:52+08:00 Starting Org Manager service. [INFO] 2026-09-03T08:50:52+08:00 Starting services for Org <root> (root) [INFO] 2026-09-03T08:50:52+08:00 Starting Journal service for Org <root> (root). [INFO] 2026-09-03T08:50:52+08:00 Starting user manager service for org root [INFO] 2026-09-03T08:50:52+08:00 Starting the notification service for Org <root> (root). [INFO] 2026-09-03T08:50:52+08:00 Installing Dummy inventory_service. Will download tools to temp directory. [INFO] 2026-09-03T08:50:52+08:00 Starting repository manager for Org <root> (root) [INFO] 2026-09-03T08:50:53+08:00 Loaded 421 built in artifacts in 155.7785ms [ERROR] 2026-09-03T08:50:53+08:00 client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context [ { "RepackInfo": null } ][DEBUG] 2026-09-03T08:50:53+08:00 Query Stats: {"RowsScanned":1,"PluginsCalled":1,"FunctionsCalled":1,"ProtocolSearch":0,"ScopeCopy":3} [INFO] 2026-09-03T08:50:53+08:00 Exiting notification service for Org <root> (root)! velociraptor: error: config repack: client_repack: Provided config file not valid: LiteralLoader: yaml: line 19: mapping values are not allowed in this context C:\Program Files\Velociraptor>

ㄧ檢視說明

檢視client.config.yaml內容依舊。

失敗，待研究，待續

(待續)