Velociraptor Service Not Working? Use This Task Scheduler Method Instead

3 hours ago
5 min read

As you guys remember, I have created a complete series on Velociraptor. If you didn't check it out, do check it out - link below.

https://www.cyberengage.org/courses-1/mastering-velociraptor%3A-a-comprehensive-guide-to-incident-response-and-digital-forensics

Now, why am I here again? Because I recently tried to install Velociraptor with the latest version on my laptop and ran into some issues.

Well, not exactly "issues" - I'd say it's more like modifications in how things work now.

------------------------------------------------------------------------------------------------------------

What Seems to be Changed in the Latest Version?

Issue #1: Client Config No Longer Auto-Generated

Earlier, when you generated the server config file, the client config file used to get automatically generated too. That doesn't happen anymore!

So now you need to manually generate the client config file using this command:

velociraptor-v0.75.1-windows-amd64.exe --config server.config.yaml config client > client.config.yaml

This is only for Windows. I'll let you know if something changes for Linux in future articles.

Issue #2: Windows Service Doesn't Work Properly

Now here's the bigger problem I faced. I'm not sure why, but on my laptop I could not run Velociraptor as a Windows service properly.

What happened was:

I installed Velociraptor as a service ✅
The service showed "RUNNING" status ✅
But when I closed the terminal, the console stopped working ❌
Browser showed "Site not reachable" ❌

I checked a lot, tried to find solutions everywhere, but didn't find any proper fix. The built-in service install command just wasn't working the way it should.

So I came up with another solution that works perfectly for both server and client!

The Solution: Task Scheduler + VBScript Method

Instead of fighting with Windows Services, we're going to use Task Scheduler with VBScript. This method:

✅ Runs Velociraptor completely hidden (no terminal window)
✅ Starts automatically on boot/login
✅ Works reliably every single time
✅ Easy to set up and manage

Let me show you how to set up both server and client.

Part 1: Setting Up Velociraptor SERVER

Step 1: Generate Server Config (if you haven't already)

cd C:\Users\YourUsername\Downloads
velociraptor-v0.75.1-windows-amd64.exe config generate -i

If you want to see what next in first step, Check out above above article

Follow the prompts to create your server.config.yaml file.

Step 2: Create VBScript to Run Server Hidden

Open Notepad and create a new file:

notepad start-velociraptor-server-hidden.vbs

Paste this code:

Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "cmd /c cd C:\Users\<YourUsername>\Downloads && velociraptor-v0.75.1-windows-amd64.exe --config server.config.yaml frontend", 0, False

Important: Replace C:\Users\YourUsername\Downloads with your actual path!

Save and close Notepad.

Step 3: Set Up Task Scheduler for Server

Now let's make it auto-start:

Press Windows Key + R, type taskschd.msc, and press Enter
Click "Create Basic Task" on the right side
Name: Velociraptor ServerDescription: Runs Velociraptor server on loginClick Next
Trigger: Select "When I log on"Click Next
Action: Select "Start a program"Click Next
Program/script: Browse and select your VBS file:
C:\Users\YourUsername\Downloads\start-velociraptor-server-hidden.vbs
Click Next
Check "Open the Properties dialog" and click Finish
In the Properties dialog:
- Go to "General" tab
- Check "Run with highest privileges"
- Go to "Settings" tab
- Uncheck "Stop the task if it runs longer than"
- Click OK

Step 4: Test Your Server

You can manually start the task to test it:

schtasks /run /tn "Velociraptor Server"

Wait 10-15 seconds, then open your browser and go to:

https://<IP> : <Port>

You should see the Velociraptor login page! No terminal window anywhere - it's running completely hidden in the background.

-----------------------------------------------------------------------------------------------------

Part 2: Setting Up Velociraptor CLIENT

Step 1: Generate Client Config

From your server machine, generate the client config:

cd C:\Users\YourUsername\Downloads
velociraptor-v0.75.1-windows-amd64.exe --config server.config.yaml config client > client.config.yaml

Copy this client.config.yaml file to the client machine (the laptop/computer you want to monitor).

Step 2: Create VBScript to Run Client Hidden

On the client machine, open Notepad:

notepad start-velociraptor-client-hidden.vbs

Paste this code:

Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "cmd /c cd C:\Users\YourUsername\Downloads && velociraptor-v0.75.1-windows-amd64.exe --config client.config.yaml client", 0, False

Important: Replace the path with your actual path! Save and close.

Step 3: Set Up Task Scheduler for Client

This is slightly different from the server because we want the client to run even before anyone logs in:

Press Windows Key + R, type taskschd.msc, and press Enter
Click "Create Basic Task"
Name: Velociraptor ClientDescription: Runs Velociraptor client on system startupClick Next
Trigger: Select "When the computer starts" ⚠️ (Important!)Click Next
Action: Select "Start a program"Click Next
Program/script: Browse and select your VBS file:
C:\Users\YourUsername\Downloads\start-velociraptor-client-hidden.vbs
Click Next
Check "Open the Properties dialog" and click Finish
In the Properties dialog:
- Go to "General" tab
- Select "Run whether user is logged on or not" ⚠️ (Important!)
- Check "Run with highest privileges"
- Check "Hidden"
- Go to "Settings" tab
- Uncheck "Stop the task if it runs longer than"
- Click OK
- Enter your Windows password when prompted

Step 4: Test Your Client

Manually start the client task:

schtasks /run /tn "Velociraptor Client"

Wait about 30 seconds, then check your Velociraptor server web interface. You should see the new client appear in your client list!

-----------------------------------------------------------------------------------------------------

Quick Command Line Method (For Advanced Users)

If you prefer using command line instead of the GUI, here are the commands:

For Server:

schtasks /create /tn "Velociraptor Server" /tr "C:\Path\To\start-velociraptor-server-hidden.vbs" /sc onlogon /rl highest

For Client:

schtasks /create /tn "Velociraptor Client" /tr "C:\Path\To\start-velociraptor-client-hidden.vbs" /sc onstart /ru SYSTEM /rl highest

-----------------------------------------------------------------------------------------------------

Why This Method is Better

Let me break down why I prefer this method over the built-in Windows Service:

It actually works! - No more "site not reachable" issues
Completely hidden - No annoying terminal windows
Auto-starts reliably - Works every time after reboot
Easy to manage - Use Task Scheduler GUI to start/stop/disable
Works for both server and client - One consistent method

Server vs Client Differences

Feature	Server	Client
Trigger	When I log on	When computer starts
Run as	Current user	SYSTEM account
Purpose	Run when you're working	Run always, even offline

The client setup ensures it:

✅ Runs even before anyone logs in
✅ Keeps running if user logs out
✅ Survives reboots automatically
✅ Keeps trying to reconnect even when offline

-----------------------------------------------------------------------------------------------------

Want to stop Velociraptor?

Open Task Scheduler
Find the task (Velociraptor Server or Client)
Right-click → Disable

Want to completely remove it?

# Stop and delete the scheduled tasks
schtasks /end /tn "Velociraptor Server"
schtasks /delete /tn "Velociraptor Server" /f

schtasks /end /tn "Velociraptor Client"
schtasks /delete /tn "Velociraptor Client" /f

# Kill any running processes
taskkill /F /IM velociraptor-v0.75.1-windows-amd64.exe

-----------------------------------------------------------------------------------------------------

Final Thoughts

Look, I know the official documentation says to use service install, but in my experience on Windows, it just doesn't work reliably. The Task Scheduler method might seem like a workaround, but honestly, it's more reliable and easier to troubleshoot.

I've been running Velociraptor this way for a while now, and it's been rock solid. No issues, no headaches, just works!

If you guys have any questions or run into any issues, drop a comment below. I'm always happy to help!

And if this helped you, don't forget to check out my complete Velociraptor series for more tips and tricks!

https://www.cyberengage.org/courses-1/mastering-velociraptor%3A-a-comprehensive-guide-to-incident-response-and-digital-forensics

Happy hunting! 🦖

----------------------------------------------Dean---------------------------------------------------

Please access this website using a laptop / desktop or tablet for the best experience

Velociraptor Service Not Working? Use This Task Scheduler Method Instead

What Seems to be Changed in the Latest Version?

Issue #1: Client Config No Longer Auto-Generated

Issue #2: Windows Service Doesn't Work Properly

The Solution: Task Scheduler + VBScript Method

Part 1: Setting Up Velociraptor SERVER

Step 1: Generate Server Config (if you haven't already)

Step 2: Create VBScript to Run Server Hidden

Step 3: Set Up Task Scheduler for Server

Step 4: Test Your Server

Part 2: Setting Up Velociraptor CLIENT

Step 1: Generate Client Config

Step 2: Create VBScript to Run Client Hidden

Step 3: Set Up Task Scheduler for Client

Step 4: Test Your Client

Quick Command Line Method (For Advanced Users)

Why This Method is Better

Server vs Client Differences

Final Thoughts

Recent Posts

Comments