Slide Agent¶

The Slide Agent is a Windows application that runs as a system service and communicates with the Slide Box and the Slide Cloud to facilitate backups. For backups to function, the Slide Agent must be installed on the computer that you want to back up.

This page is intended to explain how the Slide Agent works, and to make sure it functions well in your environment.

Installation¶

You can download the latest Slide Agent from slide.tech/agent. When installing manually, you will be prompted by Windows with the User Account Control dialog. Click Yes to allow the installation to proceed. After that, the Slide Agent installer will guide you through the installation process. Click Next to proceed.

After the installation is complete, you will see the Slide Agent as a Windows tray icon in the bottom right of the task bar. Until it is paired, the icon will be gray and show a pairing code. Navigate to your Slide Boxes page to pair the Slide Agent with a Slide Box. Detailed steps can also be found in the Getting Started guide.

Silent Installation¶

You can also install the Slide Agent silently using the command line. To do this, open an elevated command prompt ("Run As Administrator") and run SlideAgent.exe /S. This will install the Slide Agent without any user interaction.

RMM Installation¶

As of today, the Slide Agent does not integrate directly with Remote Monitoring and Management (RMM) tools. However, you can use the silent installation method to deploy the Slide Agent through your RMM tool.

We are actively working on integrating the Slide Agent with RMM tools. If you are interested in this feature, please reach out to us.

Agent Updates¶

The Slide Agent updates automatically every 1-4 weeks in the background. When an update is available, the Slide Agent will download and install it automatically.

Updates are downloaded from the Slide update servers and are signed using the "Project Orca Inc" certificate (see certificates for details). Please refer to the networking requirements for more information on the Slide Agent's network requirements.

Services, Files and Registry¶

Once installed and running, the Slide Agent will create the following services and files:

Program Files¶

The agent's program files reside in C:\Program Files\Slide\Agent. The following important files are located in this directory, though there are more files that are part of the Slide Agent:

• SlideAgent.exe: The Slide Agent service executable. It runs as a Windows service and is responsible for managing backups and communicating with the Slide Box and Slide Cloud.
• SlideAgentGUI.exe: The Slide Agent tray icon executable. It communicates with the Slide Agent to display status in the Windows tray.
• SlideAgentUninstall.exe: The Slide Agent uninstaller executable. It removes the Slide Agent from the computer.
• SlideAgentUpdate.exe: If an update is available, this is where the new version of the Slide Agent is downloaded to and installed from.
• SlideCBT.cat/sys/inf/dll: The Slide Agent's Change Block Tracking (CBT) driver files. These files are used to perform incremental backups.
• utildll.dll: A utility DLL used by the Slide Agent.
• InstallHelper.exe: An executable that helps install the SlideCBT driver.

The Slide Agent creates the following registry keys to manage the Slide Agent service:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SlideAgent: Registers the Slide Agent service with Windows.

The user-space executables are signed by Project Orca Inc, issued by DigiCert Inc. See certificates for more information.

Drivers¶

The Slide Agent installs a driver to enable Change Block Tracking (CBT) for incremental backups. This driver is installed as an upper-level filter driver. It tracks all changes made to the volumes so that the Slide Agent can perform efficient incremental backups.

This driver is installed to the following location:

• C:\Windows\System32\drivers\SlideCBT.sys: The driver file.
• C:\Windows\System32\CatRoot\oem*.cat (or SlideCBT.cat): The driver catalog file.
• C:\Windows\INF\oem\*.inf/pnf (or SlideCBT.inf/pnf): The driver installation files.

To register itself as a filter driver, the Slide Agent adds the value SlideCBT to the following registry keys:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{533c5b84-ec70-11d2-9505-00c04f79deaf}\UpperFilters
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}\UpperFilters

Please note that the SlideCBT.sys driver is marked as boot-start. This means that the driver is loaded very early in the boot process. This is necessary for the driver to track changes to the volumes.

Program Data¶

The agent's program data resides in C:\ProgramData\Slide\Agent. This is where the agent stores its configuration, logs, and other data. Most files are created by the Slide Agent itself, but some are created during the installation process. The following important files are located in this directory:

• endpoint.crt/key: The agent's X.509 certificate and private key. These files are used to authenticate the agent with the Slide Box and Slide Cloud.
• agent.db/db-wal/db-shm: The agent's SQLite database files. These files store the agent's configuration.
• logs/: The agent's log files. These files contain information about the agent's operation and can be useful for troubleshooting. Logs are automatically rotated and compressed to save disk space. Maximum log size is 100MB (usually around 1-3 MB after compression). We keep the last 10 logs.

Certificates¶

The agent and the driver are digitally signed. This section provides information about the certificates used to sign the agent and driver.

Certificates used to sign the Slide Agent¶

All executables, drivers and DLLs are signed by Project Orca Inc, issued by DigiCert Inc. This ensures that the files are not tampered with and are from a trusted source.

Certificate details:

• Issued to: Project Orca Inc
• Issued by: DigiCert Inc
• Valid from: Monday, January 6, 2025
• Valid to: Friday, February 13, 2026
• Serial number: 06b985d030101c373b408408e3766b58
• Thumbprint: 3cf1ad2222697a8e502f411d975835c1703cf659

Certificates used to sign the SlideCBT driver¶

The SlideCBT driver is signed by Microsoft Windows Hardware Compatibility Publisher, which is a standard certificate used for Windows drivers.

Certificate details:

• Issued to: Microsoft Windows Hardware Compatibility Publisher
• Issued by: Microsoft Windows Third Party Component CA 2014
• Valid from: Thursday, October 10, 2024
• Valid to: Wednesday, October 8, 2025 3:04:52 PM
• Serial number: 330000006daa072f958218c9e300000000006d
• Thumbprint: e9cdd462c16f54b9a333949b784cb0f5298a1f3d

Security Software¶

The Slide Agent performs very low-level operations on the computer, such as interacting with the Volume Shadow Copy Service (VSS). This can sometimes trigger security software to flag the Slide Agent as a potential threat. This section provides information on how to configure security software to work with the Slide Agent.

SentinelOne¶

SentinelOne is an AI-driven cybersecurity platform that provides real-time threat prevention, detection, response, and remediation across endpoints and cloud environments. It is known to flag the Slide Agent as a potential threat due to the low-level operations it performs.

Disable Snapshots¶

SentinelOne Snapshots lets you capture the state of a system at a point in time - typically before and after a detected threat. Unfortunately, it also uses the Volume Shadow Copy Service (VSS) to create these snapshots, which can interfere with the Slide Agent's operation. To prevent this, you must disable the Snapshots feature in SentinelOne.

Navigate to the SentinelOne console and disable the Snapshots feature:

• Go to Sentinels
• Navigate to Policy
• Disable Snapshots

Add Path Exclusions¶

To prevent SentinelOne from interfering with the Slide Agent, you must add exclusions for the Slide Agent's files and directories.

In the SentinelOne console, perform the following steps:

• Navigate to Sentinels, then Exclusions
• Click Create Exclusion

Add the following Path Exclusions:

Add Certificate Exclusions¶

Add the following Certificate Exclusions:

• Signer Identity: Project Orca Inc

SentinelOne Quarantining Problem¶

Due to how SentinelOne's agent quarantines applications, it does not update the Windows boot filter drivers after quarantining an application. Therefore, quarantining of the SlideCBT.sys boot-start driver may render Windows systems unbootable.

If the recommended exclusions are not applied, SentinelOne may mistakenly flag the Slide Agent as a threat and quarantine its files, including the SlideCBT.sys boot-start driver. If this driver is quarantined without the necessary registry updates (see drivers for details), Windows will blue-screen on boot.

We’re actively working with SentinelOne to resolve this issue. Until then, please ensure all exclusions are properly configured to avoid system impact.