what LAC agent version is deployed

[MarkMalyj]

I have thousands of LAC agents, version 7.3.3.99. I am piloting an upgrade of 7.3.3.120. How do I determine whether an individual LAC agent has been upgraded?

I don’t see a version number on the RSA Security Console from the Access menu > Authentication Agents > Manage Existing > as in the screenshot WhereIsLACversion.PNG

[PiersB]

The agent version information for the Windows Agent is currently not maintained at the Authentication Manager. There are many products which can assist administrators in managing the versions of software installed in enterprise Windows deployments.

I believe it is also possible to silently deploy the Windows Agent via Group Policy and install a specific (and presumably up-to-date) version on your domain.

[MarkMalyj]

OK, since the LAC agent version for each machine is not visible in RSA Security Console, I will ask our SCCM team to make different SCCM collections by agent version number.
But I am having trouble identifying the file that shows the agent version, like 7.3.3.120, in the file properties. All the files that I looked at in C:\Program Files\Common Files\RSA Shared or in C:\Program Files\RSA\RSA Authentication Agent have file versions like 8.5.3.120, which match the RSA Control Center version, not the RSA Authentication Agent (aka LAC agent) version 7.3.3.120.

What file do you recommend to be the marker that SCCM uses to determine the LAC agent version?

[EdwardDavis]

check registry ProductVersion. here I am running 7.3.3.123

HKEY_LOCAL_MACHINE\SOFTWARE\RSA\RSA Authentication Agent\CurrentVersion

[MarkMalyj]

A registry marker for the LAC agent version is much more difficult as a basis for an SCCM collection, as you can see from "How to Use RegKeyToMof" http://be.enhansoft.com/post/2014/02/13/How-to-Use-RegKeyToMof.aspx. Our SCCM team does not do the RegKeyToMof approach. It is far easier for SCCM to inventory file properties. Isn't there a file somewhere that will show the LAC agent version? 

[JayGuillette · Accepted solution]

Could you check the properties on a .dll file through SCCM?

C:\Program Files\RSA\RSA Authentication Agent\Disconnected Authentication\DAsvcApiWrapper.dll is the offline API .dll file would have a file version that could be mapped to an agent version, compare to RSA Control Center Help Help about

[MarkMalyj]

Yes, SCCM easily works with DLL file properties.... I saw that file already, it matches the RSA Control Center version (like 8.4.1.120) instead of the RSA Authentication Agent version (like 7.3.3.120). Tell me, does the RSA Control Center version *always* change when you upgrade the RSA Authentication Agent version? If so, we'll use DAsvcApiWrapper.dll as the marker for SCCM.

[JayGuillette]

Mark, 

I am not sure if there is an absolute relationship between the two numbers, but I know when Engineering questions the version we report in a bug (as in they already fixed a problem) this file is the tie-breaker, and I have seen a case where the .DLL did not get updated when an new version of the agent was installed, even though the RSA Control Center said the new version, the behavior of the agent was from a bug from a previous version, and we found an old DAsvcApiWrapper.dll on the workstation (I forget if it was in C:\Program Files\RSA\RSA Authentication Agent\Disconnected Authentication\ or in C:\Windows\System32, but it was where it should not have been)

So this file is a good choice to monitor for accurate Windows Agent version.

[MarkMalyj]

OK, we'll use DAsvcApiWrapper.dll as our marker for SCCM, and we'll keep track of the version mapping between this file (like 8.4.1.120) and the LAC agent (like 7.3.3.120). Thank you everyone!