Win 2008 - MSI installer fails with firewall exception - windows

OS: Windows 2008 R2
Zabbix Agent 2 - 6.2.5
As admin, when installing Zabbix Agent 2 MSI package with a PowerShell script, I'm getting what seems to be a firewall exception. That causes MSI installer to rollback.
The MSI installation log displays some errors related to Windows Firewall.
My PS script uses these parameters:
$argList = #('/norestart',
'/qn',
'/passive',
'/l*v',
"$zabbixDir\zabbixInstall.log",
'/i',
"$dirTemp\$msiAgentZabbix",
"INSTALLFOLDER=$zabbixDir",
"LOGFILE=$zabbixDir\zabbixAgent.log",
"SERVER=$proxy",
"SERVERACTIVE=$proxy",
"HOSTNAME=$hostname",
"ENABLEPERSISTENTBUFFER=1",
"PERSISTENTBUFFERPERIOD=1d",
"PERSISTENTBUFFERFILE=$zabbixDir\zabbixAgent.db",
"ALLOWDENYKEY=AllowKey=system.run[*]",
"HOSTMETADATA=`"windows $proxyname $metadata`"")
Start-Process msiexec.exe -Wait -PassThru -ArgumentList "$argList"
I've never had an issue with the MSI installer on Win 2008 VMs, but now, with other similar VMs, I'm getting these error messages.
MSI installation Log:
MSI (s) (18:F8) [09:57:32:457]: Doing action: WixSchedFirewallExceptionsUninstall
Action ended 9:57:32: RemoveEnvironmentStrings. Return value 1.
MSI (s) (18:40) [09:57:32:457]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIC223.tmp, Entrypoint: SchedFirewallExceptionsUninstall
MSI (s) (18:34) [09:57:32:457]: Generating random cookie.
MSI (s) (18:34) [09:57:32:517]: Created Custom Action Server with PID 8076 (0x1F8C).
MSI (s) (18:C8) [09:57:32:777]: Running as a service.
MSI (s) (18:C8) [09:57:32:777]: Hello, I'm your 32bit Impersonated custom action server.
Action start 9:57:32: WixSchedFirewallExceptionsUninstall.
SchedFirewallExceptions: Component 'CONFIGFWx64' action state (1) doesn't match request (2)
SchedFirewallExceptions: No firewall exceptions scheduled
MSI (s) (18:F8) [09:57:32:787]: Doing action: RemoveFiles
Action ended 9:57:32: WixSchedFirewallExceptionsUninstall. Return value 1.
(...)
ExecFirewallExceptions: Installing firewall exception2 Zabbix Agent 2 listen port on port , protocol 6
ExecFirewallExceptions: Error 0x800706d9: failed trying to find existing port rule
ExecFirewallExceptions: Error 0x800706d9: failed to add/update port exception for name 'Zabbix Agent 2 listen port' on port , protocol 6
CustomAction WixExecFirewallExceptionsInstall returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (F4:54) [08:00:09:652]: User policy value 'DisableRollback' is 0
MSI (s) (F4:54) [08:00:09:652]: Machine policy value 'DisableRollback' is 0
Action ended 8:00:09: InstallFinalize. Return value 3.
The oddest thing is that Windows Firewall is disabled on all VMs.
So, I can't see why that would be an issue for MSI installer.
If I start the MSI installer manually using its GUI, the installation works fine.
I'm not really sure the issue is the firewall, but that was all I could find.
Any idea?

Thank you all for your considerations.
Windows Firewall service was disabled on some hosts.
To bypass the issue, I enabled the service while maintaining the Firewall turned off.
After doing so, the installation was successful.
What still bothers me, is that, if installing with the traditional GUI, there were no issues. Only when installing with PS script it failed.
For now, by checking the Firewall service, I can use the MSI package with the script.

Related

Caliber silent installation is failing only when deployed by SCCM

I have an installation for Caliber Author Suite (Micro Focus is the publisher) and my installation works when I run as system admin on the client using command prompt. I navigate to the ccmcache and run the exe with the following command line arguments:
caliber-authorsuite-115-hf7.exe /V"/qn NOADMIN=YES ALLCLIENT=YES" /S
However, when I try and install from SCCM, I get a 0x653(1619) error. I am kind of at a loss at this point. I can't see anything in the logs that can point to anything, but honestly I may be looking in the wrong logs. If the installation works in CMD, it should work in SCCM afaik.
The deployment is set up as a script installer, and I have the line copied above into the "installation program" field. "Installation start in" field is blank. Any ideas?
EDIT: I added logging and here are the results of the attempted install:
=== Verbose logging started: 1/11/2019 10:21:23 Build type: SHIP UNICODE 5.00.7601.00 Calling process: C:\Windows\SysWOW64\MSIEXEC.EXE ===
MSI (c) (58:C4) [10:21:23:811]: Resetting cached policy values
MSI (c) (58:C4) [10:21:23:811]: Machine policy value 'Debug' is 0
MSI (c) (58:C4) [10:21:23:811]: ******* RunEngine:
******* Product: C:\Windows\system32\config\systemprofile\AppData\Local\Downloaded Installations\{B8AAF34B-B4DF-4C47-8BDA-C424E745859F}\Borland Caliber Author Suite.msi
******* Action:
******* CommandLine: **********
MSI (c) (58:C4) [10:21:23:813]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (58:C4) [10:21:23:813]: Grabbed execution mutex.
MSI (c) (58:C4) [10:21:23:872]: Cloaking enabled.
MSI (c) (58:C4) [10:21:23:872]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (58:C4) [10:21:23:887]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (4C:D0) [10:21:23:921]: Running installation inside multi-package transaction C:\Windows\system32\config\systemprofile\AppData\Local\Downloaded Installations\{B8AAF34B-B4DF-4C47-8BDA-C424E745859F}\Borland Caliber Author Suite.msi
MSI (s) (4C:D0) [10:21:23:921]: Grabbed execution mutex.
MSI (s) (4C:84) [10:21:23:962]: Resetting cached policy values
MSI (s) (4C:84) [10:21:23:963]: Machine policy value 'Debug' is 0
MSI (s) (4C:84) [10:21:23:963]: ******* RunEngine:
******* Product: C:\Windows\system32\config\systemprofile\AppData\Local\Downloaded Installations\{B8AAF34B-B4DF-4C47-8BDA-C424E745859F}\Borland Caliber Author Suite.msi
******* Action:
******* CommandLine: **********
MSI (s) (4C:84) [10:21:23:964]: Note: 1: 2203 2: C:\Windows\system32\config\systemprofile\AppData\Local\Downloaded Installations\{B8AAF34B-B4DF-4C47-8BDA-C424E745859F}\Borland Caliber Author Suite.msi 3: -2147287037
MSI (s) (4C:84) [10:21:23:992]: MainEngineThread is returning 3
MSI (s) (4C:D0) [10:21:23:995]: User policy value 'DisableRollback' is 0
MSI (s) (4C:D0) [10:21:23:996]: Machine policy value 'DisableRollback' is 0
MSI (s) (4C:D0) [10:21:23:996]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (4C:D0) [10:21:24:000]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (4C:D0) [10:21:24:024]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (4C:D0) [10:21:24:025]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (4C:D0) [10:21:24:025]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress 3: 2
MSI (s) (4C:D0) [10:21:24:025]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (4C:D0) [10:21:24:025]: Restoring environment variables
MSI (c) (58:C4) [10:21:24:029]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (58:C4) [10:21:24:029]: MainEngineThread is returning 3
=== Verbose logging stopped: 1/11/2019 10:21:24 ===
Installation still works when run from elevated command prompt outside of SCCM.
EDIT 2: I set the program to install with a GUI, and kicked it off via SCCM/Software Center. I was able to click through, and then it failed on extracting the files and running the msi with "This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package". Of course this makes me think that I should re-download the installer from the vendor and update the content in SCCM - HOWEVER the installer still works fine if I kick it off manually from the cmmcache directory so it doesn't make sense that the package itself is corrupted or in any way the problem.
This setup exe extracts an msi file into the (local) appdata of the user. (you can see this line in the log: C:\Windows\system32\config\systemprofile\AppData\Local\Downloaded Installations{B8AAF34B-B4DF-4C47-8BDA-C424E745859F}\Borland Caliber Author Suite.msi).
The problem is that the appdata of the system account actually lies within system32 and system32 is a wow redirected folder.
In general on a 64Bit Windows installation there is a copy for the programs (program files is the 64bit program files (x86) the 32bit folder, and the systme files (here system32 is the 64bit and syswow64 is the 32bit folder). The Wow64 emulation is responsible for checking if a program that is run is 32bit and if it tries to access one of the folders that it thinks is 32bit (on a 32Bit Windows system32 and program files exist as well and are the 32bit versions so some programs have this hardcoded) redirect this program to the respective other one.
Now as the systemprofile is a subfolder of system32 (unlike all other profiles which are stored in C:\users and are not wow redirected) it is redirected as well.
What seems to happen here is that your executable has some mechanism to extract the contents of it's msi to the "Downloaded Installations" folder in AppData and is a 64Bit executable (so its the system32\config\systemprofile). However for some reason it is configured to run the 32Bit msiexec.exe (you can see that in the first line of the log where it says C:\Windows\SysWOW64\MSIEXEC.EXE). When this file tries to access the path it is given by the exe wow translates the system32 path to syswow64 (although the msiexec.exe still thinks it is in system32) and the msi file can no longer be found. This never happens if you try manually because a normal user has the %localappdata% folder not redirected so 32bit and 64bit applications find it just the same.
Although there are methods to suppress the folder redirection it is not clear whether this would even work here because if msiexec.exe loads e.g. a dll from system32 and the redirection would be disabled it could crash, so the best idea here is to just extract the msi file (just start the installation manually and take it from the downloaded installations folder) and then deploy with the msi file directly. (If the exe installs any prerequisites before the msi it might be necessary to also install them)

Error 0x800f0922 when installing IIS on Windows 10: "The changes couldn't be completed."

On a new installation of Windows 10 Enterprise Version 1703 I tried turning on the IIS feature, default options selected, via "Turn Windows features on or off," but ran into the error shown below:
I then attempted to install the feature using DISM. I opened an admin command prompt and entered:
Dism /Online /Enable-Feature /FeatureName:IIS-DefaultDocument /All
This should be the same as installing the default set of features for IIS. This also failed with the same error code 0x800f0922.
Lastly, I tried selecting IIS elements one piece at a time from the "Turn Windows features on and off" menu. This worked until I tried installing "HTTP Errors," which produced the window above again.
Running this command:
Dism /Online /Enable-Feature /FeatureName:IIS-HttpErrors /All
resulted in the same error.
How can I fix this?
Touch the file C:\inetpub\custerr\en-US\401-1.htm, creating any missing directories in the path, then run the installer again.
More info:
I viewed the log file for DISM located at C:\Windows\Logs\DISM\dism.log and found the following set of lines for the error:
2017-10-09 13:43:28, Error DISM DISM Package Manager: PID=4280 TID=14940 Failed finalizing changes. - CDISMPackageManager::Internal_Finalize(hr:0x800f0922)
2017-10-09 13:43:28, Error DISM DISM Package Manager: PID=4280 TID=14940 Failed processing package changes with session options - CDISMPackageManager::ProcessChangesWithOptions(hr:0x800f0922)
2017-10-09 13:43:28, Error DISM DISM Package Manager: PID=4280 TID=14940 Failed ProcessChanges. - CPackageManagerCLIHandler::Private_ProcessFeatureChange(hr:0x800f0922)
2017-10-09 13:43:28, Error DISM DISM Package Manager: PID=4280 TID=14940 Failed while processing command enable-feature. - CPackageManagerCLIHandler::ExecuteCmdLine(hr:0x800f0922)
2017-10-09 13:43:28, Info DISM DISM Package Manager: PID=4280 TID=14940 Further logs for online package and feature related operations can be found at %WINDIR%\logs\CBS\cbs.log - CPackageManagerCLIHandler::ExecuteCmdLine
2017-10-09 13:43:28, Error DISM DISM.EXE: DISM Package Manager processed the command line but failed. HRESULT=800F0922
Following the recommendation, I checked the CBS log located at C:\Windows\Logs\CBS\CBS.log and found the following line with the same timestamp:
2017-10-09 13:43:28, Error CSI 00000096 (F) STATUS_OBJECT_PATH_NOT_FOUND #5294871# from Windows::Rtl::SystemImplementation::DirectFileSystemProvider::SysCreateFile(flags = (AllowSharingViolation|AllowAccessDenied), handle = {provider=NULL, handle=0, name= ("null")}, da = (FILE_GENERIC_READ|DELETE|WRITE_DAC|WRITE_OWNER|FILE_WRITE_ATTRIBUTES|FILE_WRITE_EA|FILE_APPEND_DATA|FILE_WRITE_DATA|0x00000040), oa = #0x92431fdd18->OBJECT_ATTRIBUTES {s:48; rd:NULL; on:[38]'\??\C:\inetpub\custerr\en-US\401-1.htm'; a:(OBJ_CASE_INSENSITIVE)}, iosb = #0x92431fdd78, as = (null), fa = (FILE_ATTRIBUTE_NORMAL), sa = (FILE_SHARE_READ|FILE_SHARE_WRITE), cd = 5, co = (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|0x00004000), eab = NULL, eal = 0, disp = Invalid)
I was able to determine that it was looking for the path C:\inetpub\custerr\en-US\401-1.htm and couldn't find it. Sure enough, that path did not exist at all.
First, I tried testing permissions by giving the user object Everyone full control access to inetpub. I know, not ideal, but it was worth it to test it. I ran that DISM command again to add HttpErrors, but still failed. Finally I just created the directories custerr and en-US, and a blank text file called 401-1.htm, and tried DISM one last time. The folder instantly populated with the rest of the HTTP error pages and the installation completed.
Hope this helps someone.
I had to uninstall Windows Process Activation Service feature first, reboot, then I was able to install IIS properly.
I created the two directory paths / empty files with no change. But - I had selected to install -only- IIS Metabase and IIS 6 configuration compatability. When I additionally selected to install the IIS Management Console the procedure successfully ran to completion.
Disabling McAfee solved the problem for me.
I had this error but was able to get IIS installed just by persevering with Control Panel | Programs | Turn Windows features on and off. When I first launched this, if I just selected the top-level Internet Information Services, as I've done with every other computer and every other version of Windows, I got this response repeatedly. With or without my antivirus running (which in my case is ZoneAlarm and MalwareBytes).
I got around this by expanding the IIS entry in the feature list, and just installing a few of the individual items at a time. My goal at the start of this was just to hone in on exactly what the problem was, although I found that every sub-component installed successfully.
Pros: everything installed OK, and only one of the subcomponents required me to reboot (and even that might have been because I also took the opportunity to get rid of IE11). And I suppose it's good that I didn't have to track down the actual MS error which caused this. Cons: there are probably 30-odd subcomponents nestling in three or four tiers under the main IIS option. Even though it all worked in the end, it took a couple of hours.
I got around this by expanding the IIS entry in the feature list, and installing each individual item at a time
I run into this error while trying to install Request Monitor feature of IIS. In order to troubleshoot it, I would recommend checking:
CBS logs (C:\Windows\Logs\CBS)
DISM logs (C:\Windows\Logs\DISM)
ApplicationHost.config file (C:\Windows\System32\inetsrv\config)
The output of Dism /Online /Cleanup-Image /ScanHealth command
Procmon logs (Use Process Monitor tool)
In my case Procmon logs showed PARSE_ERROR_INFO while reading applicationHost.config file which was corrupted. Reinstalling IIS solved the issue. Source: 0x800f0922 Update IIS-RequestMonitor of package IIS-WebServer-Core-Package failed
On Windows 10, version 1909, I had to first install the "IIS Management Console" feature.
Then I was able to add the features under the IIS 6 Management Compatibility folder without getting the 0x800f0922 error.
I was able to add both [IIS 6 Management Console] and [IIS Metabase and IIS 6 configuration compatibility] at the same time.
Then I was able to install the program that needed these as prerequisites, Exchange Management Console 2010 bayy-bee! Yey Yey.
I had the same problem in a Windows Server 2012 R2. In my case it solved after running all the pending updates on windows update (even the optional ones, it was one of them)
All config files in the IIS folder has to be present too
Location:
C:\Windows\System32\inetsrv\config\

Visual Studio Package Installation Error: "Failed to initialize the PowerShell host."

I'm facing this error when I'm trying to create a webApplication Project, a message like below appears:
Package Installation Error
Could not add all required packages to the project. Thw following packages failed to install from 'C:\Program Files (x86)\Michrosoft Web Tools\Packages':
Microsoft.Web.Infrastructure.1.0.0.0: Failed to initialize the PowerShell host. If your PowerShell execution policy setting is set to AllSigned, open the Package Manager Console to initialize the host first.
jQuery.1.10.2: Failed to initialize the PowerShell host. If your PowerShell execution policy setting is set to AllSigned, open the Package Manager Console to initialize the host first.
Modernizr.2.6.2: Failed to initialize the PowerShell host. If your PowerShell execution policy setting is set to AllSigned, open the Package Manager Console to initialize the host first.
Newtonsoft.Json.6.0.4: Failed to initialize the PowerShell host. If your PowerShell execution policy setting is set to AllSigned, open the Package Manager Console to initialize the host first.
Also, after clicking OK it will continue creating the project but in the last step I have this Error message also:
Failed to initialize the PowerShell host. If your PowerShell execution policy setting is set to AllSigned, open the Package Manager Console to initialize the host first.
After all, in Package Manager Console I have this strange message appear:
An attempt was made to load a program with an incorrect format. (Exception from HRESULT: 0x8007000B)
Setting an execution policy to RemoteSigned or Unrestricted should work. It must be changed under an administrator mode via a PowerShell console. Be aware that changes will be applied according to the bit version of the PowerShell console, so 32bit or 64 bit. So if you want to install a package in Visual Studio (32 bit version) which requires a specific policy you should change settings of the policy via PowerShell (x86).
The command in PowerShell (as administrator) to set the policy to unrestricted (as noted by #Gabriel in the comments) is:
start-job { Set-ExecutionPolicy Unrestricted } -RunAs32 | wait-job | Receive-Job
Having set the policy to unrestricted, you will want to set the policy back to its original after the install is complete.
reinstall -> run the program as administrator -> connect your laptop / desktop to internet for any update or downloadable files.
I use Visual Studio 2019. Nuget packages failed to install and I got a similar error message. Since the error message says
'open the Package Manager Console to initialize the host first'
it can be opened from
View >Other windows >Package Manager Console
for me it was greyed out and the the PMC displayed message
'Registry access denied'
Since new version of Powershells do not replace older existing version and PMC is a powershell console, I believe that execution policy must be set in the PMC.
Starting Visual Studio as administrator solved the problem for me without changing execution policy.
Also see,
https://blog.jsinh.in/nuget-install-update-error-failed-to-initialize-the-powershell-host/
https://learn.microsoft.com/en-us/nuget/consume-packages/install-use-packages-visual-studio

Silent Install of DataStax Cassandra Community Edition from Windows Server fails

I am using the datastax-community-64bit_1.2.5.msi for installing on Windows VM. I am using the silent install command
msiexec /i
C:\ddapplications\cassandra\datastax-community-64bit_1.2.5.msi /quiet
/qn /le C:\ddapplications\cassandra\installlog.txt
If I run the installation command from the command line it installs as expected. No issues.
If I run the command from a Windows Service that runs as LocalSystem, I get the following error.
Is this a known issue? Is there a workaround? I also manually tried creating a group named WORKGROUP and adding the SYSTEM user to that group.
The SYSTEM user exists in the VM.
=== Logging started: 6/7/2013 23:52:23 === Error 1609. An error occurred while applying security settings. WORKGROUP\SYSTEM is not a
valid user or group. This could be a problem with the package, or a
problem connecting to a domain controller on the network. Check your
network connection and click Retry, or Cancel to end the install.
Unable to locate the user's SID, system error 1332
=== Logging stopped: 6/7/2013 23:52:25 ===
Is your VM in a domain? What is the service that you are using to trigger the installer running as?
A possible workaround may be to make that service run as Administrator.

Can't start Portal Express 7 on Windows 2003

I have a Windows 2003 SP2 Virtual Box guest in which I'm trying to install Portal Express 7.
During the installation there's a prompt that said that the Server couldn't start and I have to that manually. When I try to start it using startServer.bat I get every time this message:
ADMU3011E: Server launched but failed initialization. startServer.log,SytemOut.log(or job log in zOS) and other log files under C:\IBM\WebSphere\AppServer/profiles\default\logs\server1 should contain failure information.
ADMU7704E: Failed while trying to start the Windows Service associated with server: WebSphere_Portal;probable error executing WASService.exe: com.ibm.ws.management.tools.ProblemInWASServiceException: ADMU7711E: Unexpected exception associated with WASService.exe: exitCode = -1 during processing of server with name: WebSphere_Portal
In the logs I only found java.lang.NoClassDefFoundError:com/ibm/ffdc/impl/EmptyProvider$EmptyFfdc and several verbosegc.txt files. Have anyone succeeded in installing IBM WP 7 on Windows 2003?
PS: My problem is very similar to this DeveloperWorks post.
If you can start it manually but not through Windows Service, perhaps something got corrupted into the service definition. No problem, you may very simply remove it (WASService.exe -remove servicename in AppServer/bin directory ), and then add it again
I use a syntax like this one
wasservice -add "Cluster1_server1" -serverName "Cluster1_server1" -profilePath "D:\IBM\WebSphere\AppServer\profiles\AppSrv01" -wasHome "D:\IBM\WebSphere\AppServer" -stopArgs " -username youradmin-password yourpassword" -encodeParams
or you may also insert username and password into soap.client.props, so you don't need to change it all the times.

Resources