This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 92%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDD%3C/text%3E%3C/svg%3E)
Hello,
I am getting errors on some clients during the push of the FireEye Agent upgrade (34.28.0.14845). As it is the test collection all machines are identical and only 1 is failing with this error:
in SCToastNotification_AD@bahaa _3.log
Starting up... (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
Client is running .Net Version4.0.30319.42000 (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
Toast notification process started with command line Downloading and installing software Click to view progress. (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
The command line has 2 arguments (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
Parsed command line successfully (Microsoft.SoftwareCenter.Client.ToastNotification.App at ParseCommandLine) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
The toast has timed out (Microsoft.SoftwareCenter.Client.ToastNotification.App at ToastDismissed) SCToastNotification 11/16/2021 3:45:08 PM 3 (0x0003)
Starting up... (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Client is running .Net Version4.0.30319.42000 (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Toast notification process started with command line Installation failed The software installation was not successful. Click to view the details. (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
The command line has 2 arguments (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Parsed command line successfully (Microsoft.SoftwareCenter.Client.ToastNotification.App at ParseCommandLine) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
The user activated the toast. (Microsoft.SoftwareCenter.Client.ToastNotification.App at ToastActivated) SCToastNotification 11/16/2021 3:45:26 PM 3 (0x0003)
and in UpdateTrustedSites.log
Starting UpdateTrustedSites with TRUE https://VRPSCCMRS01.AD/CMApplicationCatalog S-1-5-21-73586283-1284227242-1801674531-296580 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.
:443/CMApplicationCatalog, zone = 258 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: GetZoneAttributes failed: 80004003 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: The URL is already in trusted site zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
Successfully added url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 to trusted sites registry key tracking UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
Starting UpdateTrustedSites with TRUE https://VRPSCCMRS01.AD:443/CMApplicationCatalog S-1-5-21-73586283-1284227242-1801674531-296580 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 258 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: GetZoneAttributes failed: 80004003 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: The URL is already in trusted site zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
Successfully added url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 to trusted sites registry key tracking UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
Not sure it is linked but these errors happened at the time of the download failing!!!
Any idea?
Thanks,
Dom
Good to know that you got the installation part sorted out. For the compliance status reporting pending "content download", is the issue now with incorrect compliance or stuck in download state for some devices?
Hello,
First Application failing:
Deployment Application Failing.
Application FireEye 34.28.0
Configuration Manager 2103 Hotfixes: KB10036164 – KB10582136 – KB10589155
AppDiscovery.log
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_1751f620-0c2b-48f0-9618-b0efd1e0c5ee" AND Revision = 4)" AppDiscovery 11/17/2021 9:03:06 AM 7236 (0x1C44)
Performing detection of app deployment type ISS - Servers - FireEye Endpoint Agent - Windows Installer (.msi file)(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_1751f620-0c2b-48f0-9618-b0efd1e0c5ee, revision 4) for system. AppDiscovery 11/17/2021 9:03:06 AM 7236 (0x1C44)
+++ Application not discovered. [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_1751f620-0c2b-48f0-9618-b0efd1e0c5ee, Revision: 4] AppDiscovery 11/17/2021 9:03:07 AM 7236 (0x1C44)
+++ Did not detect app deployment type ISS - Servers - FireEye Endpoint Agent - Windows Installer (.msi file)(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_1751f620-0c2b-48f0-9618-b0efd1e0c5ee, revision 4) for system. AppDiscovery 11/17/2021 9:03:07 AM 7236 (0x1C44)
ActionType - Install will use Content Id: Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc + Content Version: 1 for AppDT "ISS - Servers - FireEye Endpoint Agent - Windows Installer (*.msi file)" [ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_1751f620-0c2b-48f0-9618-b0efd1e0c5ee], Revision - 4 AppDiscovery 11/17/2021 9:03:07 AM 7236 (0x1C44)
CAS.log
Requesting locations synchronously for content Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1 with priority Foreground ContentAccess 11/17/2021 9:03:07 AM 9608 (0x2588)
**** Received request for content Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1, size(KB) 30611, under context System with priority Foreground. ContentAccess 11/17/2021 9:03:07 AM 9608 (0x2588)
Saved Content ID Mapping Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1, C:\Windows\ccmcache\n ContentAccess 11/17/2021 9:03:07 AM 9608 (0x2588)
Content for Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1 was found in cache, content size is 30611K ContentAccess 11/17/2021 9:03:07 AM 9608 (0x2588)
Saved Content ID Mapping Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1, C:\Windows\ccmcache\n ContentAccess 11/17/2021 9:03:07 AM 9608 (0x2588)
CacheManager: SetCachedContentInUseFlag no change. Value : false ContentAccess 11/17/2021 9:03:32 AM 9640 (0x25A8)
Releasing content request {924873F6-BF55-4700-BCFE-E5421FB1528B} ContentAccess 11/17/2021 9:03:32 AM 768 (0x0300)
CacheManager: All references to cached Content Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1 have been removed, content is tombstoned and may be removed during future grooming operations. ContentAccess 11/17/2021 9:03:32 AM 768 (0x0300)
Saved Content ID Mapping Content_0aac80c3-cc66-4e86-a76a-fac770bfa7cc.1, C:\Windows\ccmcache\n ContentAccess 11/17/2021 9:03:32 AM 768 (0x0300)
ContentTransferManager.log
Nothing!!! On 11/17/2011 ???
DataTransferService.log
Enumerating DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 7:59:13 AM 3372 (0x0D2C)
Enumeration of DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 7:59:13 AM 3372 (0x0D2C)
Enumerating DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 7:59:13 AM 3372 (0x0D2C)
Enumeration of DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 7:59:13 AM 3372 (0x0D2C)
Enumerating DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 9:02:17 AM 7920 (0x1EF0)
Enumeration of DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 9:02:17 AM 7920 (0x1EF0)
Enumerating DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 9:02:17 AM 7920 (0x1EF0)
Enumeration of DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 9:02:17 AM 7920 (0x1EF0)
Thanks,
Dom
Deployment Application Failing.
Application Splunk 8.1.6
AppDiscovery.log
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3711d53d-4eb9-4f15-a4f0-d8ced7cf93a9" AND Revision = 7)" AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Performing detection of app deployment type ISS - Servers - Rapid7 InsightVM Agent(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3711d53d-4eb9-4f15-a4f0-d8ced7cf93a9, revision 7) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3711d53d-4eb9-4f15-a4f0-d8ced7cf93a9, Revision: 7] AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Detected app deployment type ISS - Servers - Rapid7 InsightVM Agent(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3711d53d-4eb9-4f15-a4f0-d8ced7cf93a9, revision 7) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_2f1ecd5e-a362-4093-994c-a9e9f47cf2e0" AND Revision = 5)" AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Performing detection of app deployment type RegistryKeysIEScript(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_2f1ecd5e-a362-4093-994c-a9e9f47cf2e0, revision 5) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_2f1ecd5e-a362-4093-994c-a9e9f47cf2e0, Revision: 5] AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Detected app deployment type RegistryKeysIEScript(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_2f1ecd5e-a362-4093-994c-a9e9f47cf2e0, revision 5) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3d341a06-77e1-4ba5-9a85-b5717df5491f" AND Revision = 13)" AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Performing detection of app deployment type ISS - Servers - VMTools Upgrade(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3d341a06-77e1-4ba5-9a85-b5717df5491f, revision 13) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Discovered application [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3d341a06-77e1-4ba5-9a85-b5717df5491f, Revision: 13] AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
+++ Detected app deployment type ISS - Servers - VMTools Upgrade(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_3d341a06-77e1-4ba5-9a85-b5717df5491f, revision 13) for system. AppDiscovery 11/17/2021 12:39:02 PM 7240 (0x1C48)
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e" AND Revision = 4)" AppDiscovery 11/17/2021 12:39:08 PM 7240 (0x1C48)
Performing detection of app deployment type ISS - Servers - Splunk Universal Forwarder 8.1.6(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, revision 4) for system. AppDiscovery 11/17/2021 12:39:08 PM 7240 (0x1C48)
+++ Application not discovered. [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, Revision: 4] AppDiscovery 11/17/2021 12:39:08 PM 7240 (0x1C48)
+++ Did not detect app deployment type ISS - Servers - Splunk Universal Forwarder 8.1.6(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, revision 4) for system. AppDiscovery 11/17/2021 12:39:08 PM 7240 (0x1C48)
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e" AND Revision = 4)" AppDiscovery 11/17/2021 12:39:36 PM 7240 (0x1C48)
Performing detection of app deployment type ISS - Servers - Splunk Universal Forwarder 8.1.6(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, revision 4) for system. AppDiscovery 11/17/2021 12:39:36 PM 7240 (0x1C48)
+++ Application not discovered. [AppDT Id: ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, Revision: 4] AppDiscovery 11/17/2021 12:39:36 PM 7240 (0x1C48)
+++ Did not detect app deployment type ISS - Servers - Splunk Universal Forwarder 8.1.6(ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e, revision 4) for system. AppDiscovery 11/17/2021 12:39:36 PM 7240 (0x1C48)
CAS.log
Saved Content ID Mapping Content_11c3db92-5ed8-4f47-86ca-9ec98d72d8b8.1, C:\Windows\ccmcache\m ContentAccess 11/17/2021 12:39:00 PM 6252 (0x186C)
Requesting locations synchronously for content Content_d36a34ca-5892-4c0f-87a5-66b932926307.1 with priority Foreground ContentAccess 11/17/2021 12:39:36 PM 6252 (0x186C)
ContentLocationRequest : <ContentLocationRequest SchemaVersion="1.00" BGRVersion="1" ExcludeFileList=""><Package ID="UID:Content_d36a34ca-5892-4c0f-87a5-66b932926307" Version="1" DeploymentFlags="9223372036855305058"/><AssignedSite SiteCode="UCP"/><ClientLocationInfo LocationType="SMSUpdate" DistributeOnDemand="0" UseAzure="1" AllowWUMU="0" UseInternetDP="0" AllowHTTP="1" AllowSMB="1" AllowMulticast="1" AllowSuperPeer="1" DPTokenAuth="1"><ADSite Name="SDSC"/><Forest Name="ad"/><Domain Name="ad"/><IPAddresses><IPAddress SubnetAddress="10.12.172.0" Address="10.12.172.88"/></IPAddresses><Adapters><Adapter Name="Ethernet0" IfType="6" PhysicalAddressExists="1" DnsSuffix="" Description="vmxnet3 Ethernet Adapter"/></Adapters><BoundaryGroups BoundaryGroupListRetrieveTime="2021-11-16T23:31:00.647" IsOnVPN="0"><BoundaryGroup GroupID="16777219" GroupGUID="CBE303DF-7E0D-4393-AF2F-0FCA1721F057" GroupFlag="0"/></BoundaryGroups></ClientLocationInfo></ContentLocationRequest>
ContentAccess 11/17/2021 12:39:36 PM 6252 (0x186C)
Reply Message Body : <ContentLocationReply SchemaVersion="1.00" BGRVersion="1" ContentFlags="200960" HashAlgorithm="32780" AlgorithmPreference="4" Hash="0DAE6CF5DBCCEB9BC0426F5021B5A58AE99DF4885E112436789B2016FE598BB3" ExcludeFileListHash="" RelatedContentID="Content_d2827e4d-0a47-4d29-85c3-4e88d145b5bc.1"><BoundaryGroups BoundaryGroupListRetrieveTime="2021-11-16T23:31:00.647" IsOnVPN="0"><BoundaryGroup GroupID="16777219" GroupGUID="CBE303DF-7E0D-4393-AF2F-0FCA1721F057" GroupFlag="0"/></BoundaryGroups><ContentInfo/><Sites><Site><MPSite SiteCode="UCP" MasterSiteCode="UCP" SiteLocality="FALLBACK"/><LocationRecords/></Site></Sites><RelatedContentIDs><RelatedContentID ID="Content_d2827e4d-0a47-4d29-85c3-4e88d145b5bc.1"/></RelatedContentIDs></ContentLocationReply> ContentAccess 11/17/2021 12:39:37 PM 6252 (0x186C)
sRelatedContentIDs is <RelatedContentIDs><RelatedContentID ID="Content_d2827e4d-0a47-4d29-85c3-4e88d145b5bc.1"/></RelatedContentIDs>. Length = 110. ContentAccess 11/17/2021 12:39:37 PM 6252 (0x186C)
This machine is not a workstation, returning false for MDMIsExternallyManaged. ContentAccess 11/17/2021 12:39:37 PM 6252 (0x186C)
ConfigMgr is no longer managing WindowsDO GPO. Set to default values. Mode = LAN. GroupID = empty ContentAccess 11/17/2021 12:39:37 PM 6252 (0x186C)
The number of discovered DPs(including Branch DP and Multicast) is 0 ContentAccess 11/17/2021 12:39:37 PM 6252 (0x186C)
ContentTransferManager.log
Nothing 11/17/2011 !!
DataTransferService.log
Enumerating DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 12:27:16 PM 7164 (0x1BFC)
Enumeration of DTS jobs for logged on user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 12:27:16 PM 7164 (0x1BFC)
Enumerating DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580'. DataTransferService 11/17/2021 12:27:16 PM 7164 (0x1BFC)
Enumeration of DTS jobs for helper user 'S-1-5-21-73586283-1284227242-1801674531-296580' is complete. DataTransferService 11/17/2021 12:27:16 PM 7164 (0x1BFC)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad/SMS_MP DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
Added (source=.sms_pol?ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_663d6c74-b501-4aab-979c-5af51be1ecf8/CA.SHA256:135FF6AA9F13E7C274F60AF19EA39A01ABF487DF2294C7E07954BD7B5EBF7A82,dest=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF-Application_663d6c74-b501-4aab-979c-5af51be1ecf8-CA.2.00.tmp) pair from manifest. DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
Added (source=.sms_pol?ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/RequiredApplication_663d6c74-b501-4aab-979c-5af51be1ecf8/VI/VS.SHA256:FA85B46857B3673459FE94800B606B4E54FD01C46D24D76D1EDABAB1957A10E2,dest=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF-RequiredApplication_663d6c74-b501-4aab-979c-5af51be1ecf8-VI-VS.2.00.tmp) pair from manifest. DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
Added (source=.sms_pol?{5C6A2560-2D34-4372-9009-ED0D1DCDB614}.SHA256:B971040F0D79416B1337C3B4B8581CA58FD01ED9145C889B54BB681B8095DAAE,dest={5C6A2560-2D34-4372-9009-ED0D1DCDB614}.1.00.tmp) pair from manifest. DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\Staging'. DataTransferService 11/17/2021 12:38:57 PM 7164 (0x1BFC)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} in state 'PendingDownload'. DataTransferService 11/17/2021 12:38:57 PM 7700 (0x1E14)
DTSFlag is 0x00a0bc82 DataTransferService 11/17/2021 12:38:57 PM 4664 (0x1238)
Exclude file list: DataTransferService 11/17/2021 12:38:57 PM 4664 (0x1238)
Using branch cache option DataTransferService 11/17/2021 12:38:57 PM 4664 (0x1238)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} in state 'DownloadingData'. DataTransferService 11/17/2021 12:38:57 PM 4664 (0x1238)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:05 PM 8404 (0x20D4)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} successfully completed download. DataTransferService 11/17/2021 12:39:05 PM 8404 (0x20D4)
DTSJob {9F2243F1-D9D9-498F-8E6B-D1A412282567} in state 'NotifiedComplete'. DataTransferService 11/17/2021 12:39:05 PM 7156 (0x1BF4)
DTS job {9F2243F1-D9D9-498F-8E6B-D1A412282567} has completed:
Status : SUCCESS,
Start time : 11/17/2021 12:38:57,
Completion time : 11/17/2021 12:39:05,
Elapsed time : 7 seconds DataTransferService 11/17/2021 12:39:05 PM 7156 (0x1BF4)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/RequiredApplication_663d6c74-b501-4aab-979c-5af51be1ecf8/6/MANIFEST&Hash=0618944BEAE32159DA34E98D50C7F9A34B658E723DDEAB8B8F87A004631B48E0&Compression=zlib,dest={082C01A2-094B-4DAE-9754-6ADF63EC07D0}_1.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/RequiredApplication_663d6c74-b501-4aab-979c-5af51be1ecf8/6/PROPERTIES&Hash=BB0C5DA0B2D2A37195215170807A9A94B2306224C4483A702D0273A484235DBA&Compression=zlib,dest={082C01A2-094B-4DAE-9754-6ADF63EC07D0}_2.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\CIDownloader\Staging'. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} in state 'PendingDownload'. DataTransferService 11/17/2021 12:39:07 PM 7156 (0x1BF4)
DTSFlag is 0x00a09c82 DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Exclude file list: DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Using branch cache option DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} in state 'DownloadingData'. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:07 PM 5396 (0x1514)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} successfully completed download. DataTransferService 11/17/2021 12:39:07 PM 5396 (0x1514)
DTSJob {E0738032-8669-4532-89DE-EBA4E3337780} in state 'NotifiedComplete'. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTS job {E0738032-8669-4532-89DE-EBA4E3337780} has completed:
Status : SUCCESS,
Start time : 11/17/2021 12:39:07,
Completion time : 11/17/2021 12:39:07,
Elapsed time : 0 seconds DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_663d6c74-b501-4aab-979c-5af51be1ecf8/6/MANIFEST&Hash=E0F53DF007EE9637CD12D06C2EBF3A49EFA1635B5B004569730568BDEE54B7EF&Compression=zlib,dest={F981B488-0FD2-45EC-A4A5-725A4F416D30}_1.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/Application_663d6c74-b501-4aab-979c-5af51be1ecf8/6/PROPERTIES&Hash=E61759116EF2B68CA8D4CA0021E58C7287614FCA1DCA8C2E7C3A7E7E957555F0&Compression=zlib,dest={F981B488-0FD2-45EC-A4A5-725A4F416D30}_2.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.RequiredApplication_663d6c74-b501-4aab-979c-5af51be1ecf8:6&Hash=BA2B70639599A6BDB621C77D38F97642F2427909BEC5EF1F0B4FE5A61378E95C&Compression=zlib,dest={082C01A2-094B-4DAE-9754-6ADF63EC07D0}_Model_VS.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\CIDownloader\Staging'. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} in state 'PendingDownload'. DataTransferService 11/17/2021 12:39:07 PM 7156 (0x1BF4)
DTSFlag is 0x00a09c82 DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Exclude file list: DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Using branch cache option DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} in state 'DownloadingData'. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:07 PM 5396 (0x1514)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} successfully completed download. DataTransferService 11/17/2021 12:39:07 PM 5396 (0x1514)
DTSJob {EA72BB03-2B7F-425A-AC3C-D72D3813622D} in state 'NotifiedComplete'. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTS job {EA72BB03-2B7F-425A-AC3C-D72D3813622D} has completed:
Status : SUCCESS,
Start time : 11/17/2021 12:39:07,
Completion time : 11/17/2021 12:39:07,
Elapsed time : 0 seconds DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.Application_663d6c74-b501-4aab-979c-5af51be1ecf8:6&Hash=21B3C3DEB1FE7C6B0EF3969DB91297DEA5A1C007E90C20D2121F4A2BC5E372D5&Compression=zlib,dest={F981B488-0FD2-45EC-A4A5-725A4F416D30}_Model_VS.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e/4/MANIFEST&Hash=0B43071D71EF5360EAB9E8566C623F0C2E6DFD11B6DB72AAC3A1568AE7C68F0B&Compression=zlib,dest={1112AB6F-B92E-4827-AFE3-DF36C573BD9C}_1.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
Added (source=.sms_dcm?Id&DocumentId=ScopeId_67BB9074-421B-4166-A053-A8090F9523EF/DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e/4/PROPERTIES&Hash=47CBD19A5DF7BDDBF371D362CF8792C258838243841EF21A8F38B9AB9967C59C&Compression=zlib,dest={1112AB6F-B92E-4827-AFE3-DF36C573BD9C}_2.zip) pair from manifest. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\CIDownloader\Staging'. DataTransferService 11/17/2021 12:39:07 PM 7880 (0x1EC8)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} in state 'PendingDownload'. DataTransferService 11/17/2021 12:39:07 PM 7156 (0x1BF4)
DTSFlag is 0x00a09c82 DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Exclude file list: DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
Using branch cache option DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} in state 'DownloadingData'. DataTransferService 11/17/2021 12:39:07 PM 7700 (0x1E14)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:08 PM 5396 (0x1514)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} successfully completed download. DataTransferService 11/17/2021 12:39:08 PM 5396 (0x1514)
DTSJob {2E399051-D7C7-400A-A1E9-700E0AF69A8D} in state 'NotifiedComplete'. DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
DTS job {2E399051-D7C7-400A-A1E9-700E0AF69A8D} has completed:
Status : SUCCESS,
Start time : 11/17/2021 12:39:07,
Completion time : 11/17/2021 12:39:08,
Elapsed time : 0 seconds DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e:4&Hash=D9183B89D7A70A07253B1390A6938A51D34D7C19B4A6640313DD5455599D2279&Compression=zlib,dest={1112AB6F-B92E-4827-AFE3-DF36C573BD9C}_Model_VS.zip) pair from manifest. DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\CIDownloader\Staging'. DataTransferService 11/17/2021 12:39:08 PM 7700 (0x1E14)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} in state 'PendingDownload'. DataTransferService 11/17/2021 12:39:08 PM 7156 (0x1BF4)
DTSFlag is 0x00a09c82 DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
Exclude file list: DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
Using branch cache option DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} in state 'DownloadingData'. DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:08 PM 8404 (0x20D4)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} successfully completed download. DataTransferService 11/17/2021 12:39:08 PM 8404 (0x20D4)
DTSJob {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} in state 'NotifiedComplete'. DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
DTS job {ADDCD796-278D-4F5C-B87C-C2D65F67E18E} has completed:
Status : SUCCESS,
Start time : 11/17/2021 12:39:08,
Completion time : 11/17/2021 12:39:08,
Elapsed time : 0 seconds DataTransferService 11/17/2021 12:39:08 PM 7880 (0x1EC8)
UpdateURLWithTransportSettings(): OLD URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
UpdateURLWithTransportSettings(): NEW URL - https://VRPSCCMMS03.ad:443/SMS_MP DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.Application_663d6c74-b501-4aab-979c-5af51be1ecf8:6&Hash=21B3C3DEB1FE7C6B0EF3969DB91297DEA5A1C007E90C20D2121F4A2BC5E372D5&Compression=zlib,dest={A3BD925A-B03F-4E07-A0CA-B0D8092DD130}_Model_VS.zip) pair from manifest. DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.Application_663d6c74-b501-4aab-979c-5af51be1ecf8:6:VL&Hash=F859E11AE2A8431876A9EE6F3133D00CF899EF130BD4BCB33E20C579E6F764CC&Compression=zlib,dest={A3BD925A-B03F-4E07-A0CA-B0D8092DD130}_Model_VL.zip) pair from manifest. DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e:4&Hash=D9183B89D7A70A07253B1390A6938A51D34D7C19B4A6640313DD5455599D2279&Compression=zlib,dest={5484A516-7E3C-4438-9C91-3909DB286903}_Model_VS.zip) pair from manifest. DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
Added (source=.sms_dcm?Id&DocumentId=urn:policy-platform:policy.microsoft.com:smlif:ms.dcm.ScopeId_67BB9074-421B-4166-A053-A8090F9523EF.DeploymentType_f585e4e9-b59f-46a5-9262-e7b0d0a1914e:4:VL&Hash=F5D21DE5A51F59B89E1C02CE2AC617DFD848A8771CD1D0D1795ACF248C7AC569&Compression=zlib,dest={5484A516-7E3C-4438-9C91-3909DB286903}_Model_VL.zip) pair from manifest. DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
DTSJob {1294DA42-0426-4323-8B49-03E3B4631465} created to download from 'https://VRPSCCMMS03.ad:443/SMS_MP' to 'C:\Windows\CCM\CIDownloader\Staging'. DataTransferService 11/17/2021 12:39:16 PM 7156 (0x1BF4)
DTSJob {1294DA42-0426-4323-8B49-03E3B4631465} in state 'PendingDownload'. DataTransferService 11/17/2021 12:39:16 PM 6252 (0x186C)
DTSFlag is 0x00a09c82 DataTransferService 11/17/2021 12:39:16 PM 7880 (0x1EC8)
Exclude file list: DataTransferService 11/17/2021 12:39:16 PM 7880 (0x1EC8)
Using branch cache option DataTransferService 11/17/2021 12:39:16 PM 7880 (0x1EC8)
DTSJob {1294DA42-0426-4323-8B49-03E3B4631465} in state 'DownloadingData'. DataTransferService 11/17/2021 12:39:16 PM 7880 (0x1EC8)
DTSJob {1294DA42-0426-4323-8B49-03E3B4631465} in state 'RetrievedData'. DataTransferService 11/17/2021 12:39:17 PM 5396 (0x1514)
DTSJob {1294DA42-0426-4323-8B49-03E3B4631465} successfully completed download. DataTransferService 11/17/2021 12:39
Thanks,
Dom
Hello,
I tried each process manually on some and the FireEye 34.38.0 installed successfully...
I tried each process manually on some and the Splunk 8.1.6 installed successfully...
Only when using Configuration Manager it failed...
I noticed on some machines it is even odder as the upgrade was done and in the CM Console it should failed...
::splunk installer
reg query "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE | find /i "x86" > NUL && set OS=32BIT || set OS=64BIT
if %OS%==32BIT GOTO Run32
if %OS%==64BIT GOTO Run64
:Run64
msiexec /i "%~dp0splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi" USERNAME=xxxxxxxx PASSWORD=xxxxxxxx
INSTALLDIR="%ProgramFiles%\SplunkUniversalForwarder" SERVICESTARTTYPE=auto DEPLOYMENT_SERVER="lopsplkap02.:8089" /quiet /lv "%temp/Splunk_Universal_Forwarder_install.log
Set MSIError=%Errorlevel%
::xcopy "org_all_deploymentclient*.conf" "%ProgramFiles%\SplunkUniversalForwarder\etc\system\" /s /e /i /y
for /F "tokens=3 delims=: " %%H in ('sc query "SplunkForwarder" ^| findstr " STATE"') do (
if /I "%%H" NEQ "RUNNING" (
net start "SplunkForwarder"
)
)
Set MSIError=%Errorlevel%
GOTO End
:Run32
msiexec /i "%~dp0splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi" AGREETOLICENSE=Yes DEPLOYMENT_SERVER=" lopsplkap02.:8089" /quiet /lv "%temp%/Splunk_Universal_Forwarder_install.log
Set MSIError=%Errorlevel%
:End
exit /B %MSIError%
::splunkforwarder-8.1.6-fa31da744b51-x64-release
::LOGON_USERNAME="<domain\username>" LOGON_PASSWORD="<pass>"
::
::WINEVENTLOG_APP_ENABLE=1|0
::WINEVENTLOG_SEC_ENABLE=1|0
::WINEVENTLOG_SYS_ENABLE=1|0
::WINEVENTLOG_FWD_ENABLE=1|0
::WINEVENTLOG_SET_ENABLE=1|0
::
::PERFMON=<input_type>,<input_type>,...
cpu,memory, network,diskspace
Any idea? Does the logs above show something? I am using the sane script used to previously installed 7.0.3 version of splunk..
Thanks,
Dom
Good catch I was able to install the application on two machines...
%temp% was set as %temp missing one % sign... so now it is working a little bit better on 1 machine...
=== Verbose logging started: 11/18/2021 15:02:57 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\system32\msiexec.exe ===
MSI (c) (BC:4C) [15:02:57:429]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg
MSI (c) (BC:4C) [15:02:57:429]: Font created. Charset: Req=0, Ret=0, Font: Req=MS Shell Dlg, Ret=MS Shell Dlg
MSI (c) (BC:20) [15:02:57:441]: Resetting cached policy values
MSI (c) (BC:20) [15:02:57:441]: Machine policy value 'Debug' is 0
MSI (c) (BC:20) [15:02:57:441]: ******* RunEngine:
******* Product: C:\Windows\ccmcache\q\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
******* Action:
******* CommandLine: **********
MSI (c) (BC:20) [15:02:57:443]: Machine policy value 'DisableUserInstalls' is 0
MSI (c) (BC:20) [15:02:57:452]: Cloaking enabled.
MSI (c) (BC:20) [15:02:57:452]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (BC:20) [15:02:57:454]: End dialog not enabled
MSI (c) (BC:20) [15:02:57:454]: Original package ==> C:\Windows\ccmcache\q\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
MSI (c) (BC:20) [15:02:57:454]: Package we're running from ==> C:\Windows\Installer\2ea0d09a.msi
MSI (c) (BC:20) [15:02:57:458]: APPCOMPAT: Uninstall Flags override found.
MSI (c) (BC:20) [15:02:57:458]: APPCOMPAT: Uninstall VersionNT override found.
MSI (c) (BC:20) [15:02:57:458]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (c) (BC:20) [15:02:57:459]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'.
MSI (c) (BC:20) [15:02:57:459]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (BC:20) [15:02:57:466]: MSCOREE not loaded loading copy from system32
MSI (c) (BC:20) [15:02:57:472]: Machine policy value 'DisablePatch' is 0
MSI (c) (BC:20) [15:02:57:472]: Machine policy value 'AllowLockdownPatch' is 0
MSI (c) (BC:20) [15:02:57:473]: Machine policy value 'DisableLUAPatching' is 0
MSI (c) (BC:20) [15:02:57:473]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (c) (BC:20) [15:02:57:473]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'.
MSI (c) (BC:20) [15:02:57:473]: APPCOMPAT: no matching ProductCode found in database.
MSI (c) (BC:20) [15:02:57:473]: Transforms are not secure.
MSI (c) (BC:20) [15:02:57:473]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\xxxxxxxx\AppData\Local\Temp/Splunk_Universal_Forwarder_install.log'.
MSI (c) (BC:20) [15:02:57:474]: Command Line: AGREETOLICENSE=Yes USERNAME=ad\xxxxxxxx PASSWORD=yyyyyyyy INSTALLDIR=C:\Program Files\SplunkUniversalForwarder SERVICESTARTTYPE=auto DEPLOYMENT_SERVER=lopsplkap02.xxxxxxxxx.yyyyyyyy.zzzzzzzz:8089 CURRENTDIRECTORY=C:\Windows\system32 CLIENTUILEVEL=0 CLIENTPROCESSID=1724
MSI (c) (BC:20) [15:02:57:474]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{2055C5CA-560E-4EB0-9EAE-6B9D4E75CCA9}'.
MSI (c) (BC:20) [15:02:57:474]: Product Code passed to Engine.Initialize: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (c) (BC:20) [15:02:57:474]: Product Code from property table before transforms: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (c) (BC:20) [15:02:57:474]: Product Code from property table after transforms: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (c) (BC:20) [15:02:57:474]: Product registered: entering maintenance mode
MSI (c) (BC:20) [15:02:57:474]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (c) (BC:20) [15:02:57:474]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
MSI (c) (BC:20) [15:02:57:474]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
MSI (c) (BC:20) [15:02:57:475]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (c) (BC:20) [15:02:57:475]: Specifed source is already in a list.
MSI (c) (BC:20) [15:02:57:475]: User policy value 'SearchOrder' is 'nmu'
MSI (c) (BC:20) [15:02:57:475]: Machine policy value 'DisableBrowse' is 0
MSI (c) (BC:20) [15:02:57:475]: Machine policy value 'AllowLockdownBrowse' is 0
MSI (c) (BC:20) [15:02:57:475]: Adding new sources is allowed.
MSI (c) (BC:20) [15:02:57:475]: Package name retrieved from configuration data: 'splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi'
MSI (c) (BC:20) [15:02:57:475]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:20) [15:02:57:476]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (c) (BC:20) [15:02:57:476]: Machine policy value 'DisableMsi' is 1
MSI (c) (BC:20) [15:02:57:476]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (c) (BC:20) [15:02:57:476]: User policy value 'AlwaysInstallElevated' is 0
MSI (c) (BC:20) [15:02:57:476]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is admin assigned: LocalSystem owns the publish key.
MSI (c) (BC:20) [15:02:57:476]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is managed.
MSI (c) (BC:20) [15:02:57:476]: Running product '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}' with elevated privileges: Product is assigned.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Modifying AGREETOLICENSE property. Its current value is 'No'. Its new value: 'Yes'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'xxxxxxxx'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding PASSWORD property. Its value is 'yyyyyyyy'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\SplunkUniversalForwarder'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding DEPLOYMENT_SERVER property. Its value is 'lopsplkap02:8089'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\system32'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '0'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '1724'.
MSI (c) (BC:20) [15:02:57:476]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (c) (BC:20) [15:02:57:476]: TRANSFORMS property is now:
MSI (c) (BC:20) [15:02:57:477]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
MSI (c) (BC:20) [15:02:57:477]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (c) (BC:20) [15:02:57:477]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming
MSI (c) (BC:20) [15:02:57:478]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\Favorites
MSI (c) (BC:20) [15:02:57:478]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (c) (BC:20) [15:02:57:478]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\Documents
MSI (c) (BC:20) [15:02:57:478]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (c) (BC:20) [15:02:57:479]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Recent
MSI (c) (BC:20) [15:02:57:479]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\SendTo
MSI (c) (BC:20) [15:02:57:479]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Templates
MSI (c) (BC:20) [15:02:57:479]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (c) (BC:20) [15:02:57:479]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Local
MSI (c) (BC:20) [15:02:57:480]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\Pictures
MSI (c) (BC:20) [15:02:57:480]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (BC:20) [15:02:57:480]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (BC:20) [15:02:57:480]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (c) (BC:20) [15:02:57:480]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (c) (BC:20) [15:02:57:481]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (c) (BC:20) [15:02:57:481]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (c) (BC:20) [15:02:57:481]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (c) (BC:20) [15:02:57:481]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (c) (BC:20) [15:02:57:482]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (c) (BC:20) [15:02:57:482]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxx\Desktop
MSI (c) (BC:20) [15:02:57:482]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (c) (BC:20) [15:02:57:483]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (c) (BC:20) [15:02:57:484]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 25
MSI (c) (BC:20) [15:02:57:493]: MSI_LUA: Setting AdminUser property to 1 because this is the client or the user has already permitted elevation
MSI (c) (BC:20) [15:02:57:493]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (c) (BC:20) [15:02:57:493]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (c) (BC:20) [15:02:57:493]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (c) (BC:20) [15:02:57:493]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (c) (BC:20) [15:02:57:493]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
MSI (c) (BC:20) [15:02:57:493]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\2ea0d09a.msi'.
MSI (c) (BC:20) [15:02:57:493]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Windows\ccmcache\q\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi'.
MSI (c) (BC:20) [15:02:57:493]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (c) (BC:4C) [15:02:57:509]: PROPERTY CHANGE: Adding VersionHandler property. Its value is '5.00'.
=== Logging started: 11/18/2021 15:02:57 ===
MSI (c) (BC:20) [15:02:57:516]: Note: 1: 2205 2: 3: PatchPackage
MSI (c) (BC:20) [15:02:57:516]: Machine policy value 'DisableRollback' is 0
MSI (c) (BC:20) [15:02:57:516]: User policy value 'DisableRollback' is 0
MSI (c) (BC:20) [15:02:57:516]: PROPERTY CHANGE: Adding UILevel property. Its value is '5'.
MSI (c) (BC:20) [15:02:57:517]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (c) (BC:20) [15:02:57:517]: Note: 1: 2205 2: 3: LaunchCondition
MSI (c) (BC:20) [15:02:57:517]: Note: 1: 2228 2: 3: LaunchCondition 4: SELECT Condition FROM LaunchCondition
MSI (c) (BC:20) [15:02:57:517]: APPCOMPAT: [DetectVersionLaunchCondition] Failed to initialize pRecErr.
MSI (c) (BC:20) [15:02:57:520]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (c) (BC:20) [15:02:57:520]: Doing action: INSTALL
MSI (c) (BC:20) [15:02:57:520]: Note: 1: 2205 2: 3: ActionText
Action start 15:02:57: INSTALL.
MSI (c) (BC:20) [15:02:57:520]: UI Sequence table 'InstallUISequence' is present and populated.
MSI (c) (BC:20) [15:02:57:520]: Running UISequence
MSI (c) (BC:20) [15:02:57:520]: PROPERTY CHANGE: Adding EXECUTEACTION property. Its value is 'INSTALL'.
MSI (c) (BC:20) [15:02:57:520]: Doing action: SetAllUsers
MSI (c) (BC:20) [15:02:57:520]: Note: 1: 2205 2: 3: ActionText
Action start 15:02:57: SetAllUsers.
MSI (c) (BC:E4) [15:02:57:712]: Invoking remote custom action. DLL: C:\Users\xxxxxxxx\AppData\Local\Temp\MSIA3FA.tmp, Entrypoint: SetAllUsersCA
MSI (c) (BC:34) [15:02:57:714]: Cloaking enabled.
MSI (c) (BC:34) [15:02:57:714]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (BC:34) [15:02:57:714]: Connected to service for CA interface.
SetAllUsers: Info: Registry setting for current user is not found.
SetAllUsers: Info: ALLUSERS value for the existing installation: -1.
SetAllUsers: Info: Set ALLUSERS property to 1.
SetAllUsers: Info: Leave SetAllUsers: 0x0.
Action ended 15:02:57: SetAllUsers. Return value 1.
MSI (c) (BC:20) [15:02:57:786]: Doing action: FindRelatedProducts
MSI (c) (BC:20) [15:02:57:786]: Note: 1: 2205 2: 3: ActionText
Action start 15:02:57: FindRelatedProducts.
MSI (c) (BC:20) [15:02:57:788]: Skipping FindRelatedProducts action: not run in maintenance mode
Action ended 15:02:57: FindRelatedProducts. Return value 0.
MSI (c) (BC:20) [15:02:57:788]: Skipping action: CheckSupportedOsXP (condition is false)
MSI (c) (BC:20) [15:02:57:788]: Doing action: GetPreviousSettings
MSI (c) (BC:20) [15:02:57:788]: Note: 1: 2205 2: 3: ActionText
Action start 15:02:57: GetPreviousSettings.
MSI (c) (BC:AC) [15:02:57:994]: Invoking remote custom action. DLL: C:\Users\xxxxxxxx\AppData\Local\Temp\MSIA505.tmp, Entrypoint: GetPreviousSettingsCA
GetPreviousSettings: Info: Found product to be installed in Msi database: {1F0EA823-12FF-4298-9C82-FCD86CABD59B}
GetPreviousSettings: Info: Found version 8.1.6.0 for the product {1F0EA823-12FF-4298-9C82-FCD86CABD59B}.
GetPreviousSettings: Info: Same product code is already installed. Use REINSTALL option to reinstall.
MSI (c) (BC!04) [15:02:58:033]: PROPERTY CHANGE: Adding SameProdCodeExists property. Its value is '1'.
GetPreviousSettings: Info: Examine registry for SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{1F0EA823-12FF-4298-9C82-FCD86CABD59B}.
GetPreviousSettings: Info: previous install location: C:\Program Files\SplunkUniversalForwarder\
MSI (c) (BC!04) [15:02:58:034]: PROPERTY CHANGE: Modifying INSTALLDIR property. Its current value is 'C:\Program Files\SplunkUniversalForwarder'. Its new value: 'C:\Program Files\SplunkUniversalForwarder\'.
GetPreviousSettings: Info: User account is LocalSystem
GetPreviousSettings: Info: found installed splunk products:
GetPreviousSettings: Info: ProductCode: {1F0EA823-12FF-4298-9C82-FCD86CABD59B}, ProductName: UniversalForwarder, ProductVersion: 8.1.6.0
MSI (c) (BC!04) [15:02:58:037]: PROPERTY CHANGE: Modifying DoNotInstallDrivers property. Its current value is '0'. Its new value: '1'.
GetPreviousSettings: Info: skip installing drivers. To override this setting use FORCEINSTALLDRIVERS=1
GetPreviousSettings: Info: Number of splunk products installed: 1
GetPreviousSettings: Info: Leave GetPreviousSettings: 0x0.
Action ended 15:02:58: GetPreviousSettings. Return value 1.
MSI (c) (BC:20) [15:02:58:040]: Doing action: CheckSameProdCodeExists
MSI (c) (BC:20) [15:02:58:040]: Note: 1: 2205 2: 3: ActionText
Action start 15:02:58: CheckSameProdCodeExists.
MSI (c) (BC:4C) [15:02:58:042]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:4C) [15:02:58:042]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 2898
Info 2898.For WixUI_Font_Normal textstyle, the system created a 'Tahoma' font, in 0 character set, of 19 pixels height.
MSI (c) (BC:20) [15:03:01:383]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:20) [15:03:01:383]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1709
MSI (c) (BC:20) [15:03:01:383]: Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer.
Action ended 15:03:01: CheckSameProdCodeExists. Return value 3.
MSI (c) (BC:20) [15:03:01:384]: Doing action: FatalError
MSI (c) (BC:20) [15:03:01:384]: Note: 1: 2205 2: 3: ActionText
Action start 15:03:01: FatalError.
MSI (c) (BC:4C) [15:03:01:386]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:4C) [15:03:01:386]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 2898
Info 2898.For WixUI_Font_Bigger textstyle, the system created a 'Tahoma' font, in 0 character set, of 29 pixels height.
MSI (c) (BC:50) [15:03:01:428]: Note: 1: 2731 2: 0
Action ended 15:03:03: FatalError. Return value 2.
Action ended 15:03:03: INSTALL. Return value 3.
MSI (c) (BC:20) [15:03:03:813]: Destroying RemoteAPI object.
MSI (c) (BC:34) [15:03:03:813]: Custom Action Manager thread ending.
=== Logging stopped: 11/18/2021 15:03:03 ===
MSI (c) (BC:20) [15:03:03:814]: Note: 1: 1729
MSI (c) (BC:20) [15:03:03:814]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:20) [15:03:03:814]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1729
MSI (c) (BC:20) [15:03:03:814]: Note: 1: 2205 2: 3: Error
MSI (c) (BC:20) [15:03:03:814]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1709
MSI (c) (BC:20) [15:03:03:814]: Product: UniversalForwarder -- Configuration failed.
MSI (c) (BC:20) [15:03:03:815]: Windows Installer reconfigured the product. Product Name: UniversalForwarder. Product Version: 8.1.6.0. Product Language: 1033. Manufacturer: Splunk, Inc.. Reconfiguration success or error status: 1603.
MSI (c) (BC:20) [15:03:03:818]: Grabbed execution mutex.
MSI (c) (BC:20) [15:03:03:818]: Cleaning up uninstalled install packages, if any exist
MSI (c) (BC:20) [15:03:03:819]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/18/2021 15:03:03 ===
checking the second machine as I could not see the log file... even the application is installed!!!