Deployment Application Failing!!!

Question

Hello,

I am getting errors on some clients during the push of the FireEye Agent upgrade (34.28.0.14845). As it is the test collection all machines are identical and only 1 is failing with this error:

in SCToastNotification_AD@bahaa _3.log

Starting up... (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)

Client is running .Net Version4.0.30319.42000 (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
Toast notification process started with command line Downloading and installing software Click to view progress. (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
The command line has 2 arguments (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
Parsed command line successfully (Microsoft.SoftwareCenter.Client.ToastNotification.App at ParseCommandLine) SCToastNotification 11/16/2021 3:45:01 PM 1 (0x0001)
The toast has timed out (Microsoft.SoftwareCenter.Client.ToastNotification.App at ToastDismissed) SCToastNotification 11/16/2021 3:45:08 PM 3 (0x0003)
Starting up... (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Client is running .Net Version4.0.30319.42000 (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Toast notification process started with command line Installation failed The software installation was not successful. Click to view the details. (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
The command line has 2 arguments (Microsoft.SoftwareCenter.Client.ToastNotification.App at Main) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
Parsed command line successfully (Microsoft.SoftwareCenter.Client.ToastNotification.App at ParseCommandLine) SCToastNotification 11/16/2021 3:45:23 PM 1 (0x0001)
The user activated the toast. (Microsoft.SoftwareCenter.Client.ToastNotification.App at ToastActivated) SCToastNotification 11/16/2021 3:45:26 PM 3 (0x0003)

and in UpdateTrustedSites.log

Starting UpdateTrustedSites with TRUE https://VRPSCCMRS01.AD/CMApplicationCatalog S-1-5-21-73586283-1284227242-1801674531-296580 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)

AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.

:443/CMApplicationCatalog, zone = 258 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: GetZoneAttributes failed: 80004003 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
AddDefaultPortalToTrustedSites: The URL is already in trusted site zone. UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
Successfully added url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 to trusted sites registry key tracking UpdateTrustedSites 11/16/2021 3:43:49 PM 7840 (0x1EA0)
Starting UpdateTrustedSites with TRUE https://VRPSCCMRS01.AD:443/CMApplicationCatalog S-1-5-21-73586283-1284227242-1801674531-296580 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 258 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: GetZoneAttributes failed: 80004003 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: Existing URL is empty or add to trusted sites is true and the default URL hasn't changed. Not deleting the existing URL from trusted sites list. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
CSoftwareCatalogUpdateHandler::AddDefaultPortalToTrustedSites: Catalog Url should be added to the trusted sites zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
AddDefaultPortalToTrustedSites: The URL is already in trusted site zone. UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)
Successfully added url = https://VRPSCCMRS01.AD:443/CMApplicationCatalog, zone = 2 to trusted sites registry key tracking UpdateTrustedSites 11/16/2021 3:44:54 PM 10440 (0x28C8)

Not sure it is linked but these errors happened at the time of the download failing!!!

Any idea?
Thanks,
Dom

Answer 1

Second logs when the script runs manually...

=== Verbose logging started: 11/18/2021 15:45:05 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\system32\msiexec.exe ===

MSI (c) (AC:E4) [15:45:05:312]: Resetting cached policy values
MSI (c) (AC:E4) [15:45:05:312]: Machine policy value 'Debug' is 0
MSI (c) (AC:E4) [15:45:05:312]: ******* RunEngine:
******* Product: C:\Windows\ccmcache\s\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
******* Action:
******* CommandLine: **********
MSI (c) (AC:E4) [15:45:05:313]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (AC:E4) [15:45:05:313]: Grabbed execution mutex.
MSI (c) (AC:E4) [15:45:05:354]: Cloaking enabled.
MSI (c) (AC:E4) [15:45:05:354]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (AC:E4) [15:45:05:357]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (F4:20) [15:45:05:368]: Running installation inside multi-package transaction C:\Windows\ccmcache\s\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
MSI (s) (F4:20) [15:45:05:368]: Grabbed execution mutex.
MSI (s) (F4:A0) [15:45:05:372]: Resetting cached policy values
MSI (s) (F4:A0) [15:45:05:372]: Machine policy value 'Debug' is 0
MSI (s) (F4:A0) [15:45:05:372]: ******* RunEngine:
******* Product: C:\Windows\ccmcache\s\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
******* Action:
******* CommandLine: **********
MSI (s) (F4:A0) [15:45:05:373]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (F4:A0) [15:45:05:375]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (F4:A0) [15:45:05:380]: SRSetRestorePoint skipped for this transaction.
MSI (s) (F4:A0) [15:45:05:382]: MSCOREE not loaded loading copy from system32
MSI (s) (F4:A0) [15:45:05:395]: End dialog not enabled
MSI (s) (F4:A0) [15:45:05:395]: Original package ==> C:\Windows\ccmcache\s\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi
MSI (s) (F4:A0) [15:45:05:395]: Package we're running from ==> C:\Windows\Installer\2e9fe36c.msi
MSI (s) (F4:A0) [15:45:05:399]: APPCOMPAT: Uninstall Flags override found.
MSI (s) (F4:A0) [15:45:05:399]: APPCOMPAT: Uninstall VersionNT override found.
MSI (s) (F4:A0) [15:45:05:399]: APPCOMPAT: Uninstall ServicePackLevel override found.
MSI (s) (F4:A0) [15:45:05:399]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'.
MSI (s) (F4:A0) [15:45:05:399]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (F4:A0) [15:45:05:407]: Machine policy value 'DisablePatch' is 0
MSI (s) (F4:A0) [15:45:05:407]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (F4:A0) [15:45:05:407]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (F4:A0) [15:45:05:407]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (F4:A0) [15:45:05:408]: APPCOMPAT: looking for appcompat database entry with ProductCode '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'.
MSI (s) (F4:A0) [15:45:05:408]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (F4:A0) [15:45:05:408]: Transforms are not secure.
MSI (s) (F4:A0) [15:45:05:408]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Users\rmppqx\AppData\Local\Temp/Splunk_Universal_Forwarder_install.log'.
MSI (s) (F4:A0) [15:45:05:408]: Command Line: AGREETOLICENSE=Yes USERNAME=ad\rmppqx PASSWORD=yyyyyyyy INSTALLDIR=C:\Program Files\SplunkUniversalForwarder SERVICESTARTTYPE=auto DEPLOYMENT_SERVER=lopsplkap02.xxxxxxxxx.yyyyyyyy.zzzzzzzz:8089 CURRENTDIRECTORY=C:\Windows\system32 CLIENTUILEVEL=3 CLIENTPROCESSID=6316
MSI (s) (F4:A0) [15:45:05:408]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{2055C5CA-560E-4EB0-9EAE-6B9D4E75CCA9}'.
MSI (s) (F4:A0) [15:45:05:408]: Product Code passed to Engine.Initialize: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (s) (F4:A0) [15:45:05:408]: Product Code from property table before transforms: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (s) (F4:A0) [15:45:05:408]: Product Code from property table after transforms: '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}'
MSI (s) (F4:A0) [15:45:05:408]: Product registered: entering maintenance mode
MSI (s) (F4:A0) [15:45:05:408]: Determined that existing product (either this product or the product being upgraded with a patch) is installed per-machine.
MSI (s) (F4:A0) [15:45:05:408]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is admin assigned: LocalSystem owns the publish key.
MSI (s) (F4:A0) [15:45:05:408]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is managed.
MSI (s) (F4:A0) [15:45:05:408]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (F4:A0) [15:45:05:408]: PROPERTY CHANGE: Adding ProductState property. Its value is '5'.
MSI (s) (F4:A0) [15:45:05:408]: PROPERTY CHANGE: Adding ProductToBeRegistered property. Its value is '1'.
MSI (s) (F4:A0) [15:45:05:409]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (F4:A0) [15:45:05:410]: Specifed source is already in a list.
MSI (s) (F4:A0) [15:45:05:410]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (F4:A0) [15:45:05:410]: Machine policy value 'DisableBrowse' is 0
MSI (s) (F4:A0) [15:45:05:410]: Machine policy value 'AllowLockdownBrowse' is 0
MSI (s) (F4:A0) [15:45:05:410]: Adding new sources is allowed.
MSI (s) (F4:A0) [15:45:05:410]: Package name retrieved from configuration data: 'splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi'
MSI (s) (F4:A0) [15:45:05:410]: Note: 1: 2205 2: 3: Error
MSI (s) (F4:A0) [15:45:05:411]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (F4:A0) [15:45:05:411]: Machine policy value 'DisableMsi' is 1
MSI (s) (F4:A0) [15:45:05:412]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (F4:A0) [15:45:05:412]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (F4:A0) [15:45:05:412]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is admin assigned: LocalSystem owns the publish key.
MSI (s) (F4:A0) [15:45:05:412]: Product {1F0EA823-12FF-4298-9C82-FCD86CABD59B} is managed.
MSI (s) (F4:A0) [15:45:05:412]: Running product '{1F0EA823-12FF-4298-9C82-FCD86CABD59B}' with elevated privileges: Product is assigned.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Modifying AGREETOLICENSE property. Its current value is 'No'. Its new value: 'Yes'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'ad\rmppqx'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding PASSWORD property. Its value is 'yyyyyyyy'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding INSTALLDIR property. Its value is 'C:\Program Files\SplunkUniversalForwarder'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding DEPLOYMENT_SERVER property. Its value is 'lopsplkap02.xxxxxxxxx.yyyyyyyy.zzzzzzzz:8089'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Windows\system32'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '6316'.
MSI (s) (F4:A0) [15:45:05:412]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (F4:A0) [15:45:05:412]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding MsiSystemRebootPending property. Its value is '1'.
MSI (s) (F4:A0) [15:45:05:412]: TRANSFORMS property is now:
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding PRODUCTLANGUAGE property. Its value is '1033'.
MSI (s) (F4:A0) [15:45:05:412]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (s) (F4:A0) [15:45:05:414]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming
MSI (s) (F4:A0) [15:45:05:415]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\Favorites
MSI (s) (F4:A0) [15:45:05:417]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (F4:A0) [15:45:05:418]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\Documents
MSI (s) (F4:A0) [15:45:05:420]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (F4:A0) [15:45:05:422]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (F4:A0) [15:45:05:423]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (F4:A0) [15:45:05:425]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (F4:A0) [15:45:05:425]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (F4:A0) [15:45:05:427]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Local
MSI (s) (F4:A0) [15:45:05:428]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\Pictures
MSI (s) (F4:A0) [15:45:05:431]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (F4:A0) [15:45:05:433]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (F4:A0) [15:45:05:434]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (F4:A0) [15:45:05:435]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (F4:A0) [15:45:05:437]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (F4:A0) [15:45:05:440]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (F4:A0) [15:45:05:442]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (F4:A0) [15:45:05:443]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (F4:A0) [15:45:05:445]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (F4:A0) [15:45:05:446]: SHELL32::SHGetFolderPath returned: C:\Users\xxxxxxxxx\Desktop
MSI (s) (F4:A0) [15:45:05:448]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (F4:A0) [15:45:05:449]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (s) (F4:A0) [15:45:05:449]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (F4:A0) [15:45:05:456]: MSI_LUA: Setting AdminUser property to 1 because the product is already installed managed and per-machine
MSI (s) (F4:A0) [15:45:05:456]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (F4:A0) [15:45:05:456]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding COMPANYNAME property. Its value is 'UCLA Health'.
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding Installed property. Its value is '00:00:00'.
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\2e9fe36c.msi'.
MSI (s) (F4:A0) [15:45:05:456]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Windows\ccmcache\s\splunkforwarder-8.1.6-c1a0dd183ee5-x64-release.msi'.
MSI (s) (F4:A0) [15:45:05:456]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (F4:A0) [15:45:05:456]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (F4:A0) [15:45:05:457]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (F4:A0) [15:45:05:457]: Machine policy value 'DisableRollback' is 0
MSI (s) (F4:A0) [15:45:05:457]: User policy value 'DisableRollback' is 0
MSI (s) (F4:A0) [15:45:05:457]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 11/18/2021 15:45:05 ===
MSI (s) (F4:A0) [15:45:05:458]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (F4:A0) [15:45:05:458]: Note: 1: 2205 2: 3: LaunchCondition
MSI (s) (F4:A0) [15:45:05:458]: Note: 1: 2228 2: 3: LaunchCondition 4: SELECT Condition FROM LaunchCondition
MSI (s) (F4:A0) [15:45:05:458]: APPCOMPAT: [DetectVersionLaunchCondition] Failed to initialize pRecErr.
MSI (s) (F4:A0) [15:45:05:460]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (F4:A0) [15:45:05:460]: Doing action: INSTALL
MSI (s) (F4:A0) [15:45:05:460]: Note: 1: 2205 2: 3: ActionText
Action start 15:45:05: INSTALL.
MSI (s) (F4:A0) [15:45:05:461]: Running ExecuteSequence
MSI (s) (F4:A0) [15:45:05:461]: Doing action: SetAllUsers
MSI (s) (F4:A0) [15:45:05:461]: Note: 1: 2205 2: 3: ActionText
MSI (s) (F4:74) [15:45:05:664]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI1DCA.tmp, Entrypoint: SetAllUsersCA
MSI (s) (F4:5C) [15:45:05:665]: Generating random cookie.
MSI (s) (F4:5C) [15:45:05:670]: Created Custom Action Server with PID 4468 (0x1174).
MSI (s) (F4:2C) [15:45:05:696]: Running as a service.
MSI (s) (F4:2C) [15:45:05:702]: Hello, I'm your 64bit Impersonated custom action server.
Action start 15:45:05: SetAllUsers.
SetAllUsers: Info: Registry setting for current user is not found.
SetAllUsers: Info: ALLUSERS value for the existing installation: -1.
SetAllUsers: Info: Set ALLUSERS property to 1.
SetAllUsers: Info: Leave SetAllUsers: 0x0.
MSI (s) (F4:A0) [15:45:05:735]: Doing action: FindRelatedProducts
MSI (s) (F4:A0) [15:45:05:735]: Note: 1: 2205 2: 3: ActionText
Action ended 15:45:05: SetAllUsers. Return value 1.
MSI (s) (F4:A0) [15:45:05:736]: Skipping FindRelatedProducts action: not run in maintenance mode
Action start 15:45:05: FindRelatedProducts.
MSI (s) (F4:A0) [15:45:05:736]: Skipping action: CheckSupportedOsXP (condition is false)
MSI (s) (F4:A0) [15:45:05:737]: Doing action: GetPreviousSettings
MSI (s) (F4:A0) [15:45:05:737]: Note: 1: 2205 2: 3: ActionText
Action ended 15:45:05: FindRelatedProducts. Return value 0.
MSI (s) (F4:64) [15:45:05:934]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI1EE4.tmp, Entrypoint: GetPreviousSettingsCA
Action start 15:45:05: GetPreviousSettings.
GetPreviousSettings: Info: Found product to be installed in Msi database: {1F0EA823-12FF-4298-9C82-FCD86CABD59B}
GetPreviousSettings: Info: Found version 8.1.6.0 for the product {1F0EA823-12FF-4298-9C82-FCD86CABD59B}.
MSI (s) (F4!24) [15:45:05:963]: PROPERTY CHANGE: Adding SameProdCodeExists property. Its value is '1'.
GetPreviousSettings: Info: Same product code is already installed. Use REINSTALL option to reinstall.
GetPreviousSettings: Info: Examine registry for SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{1F0EA823-12FF-4298-9C82-FCD86CABD59B}.
MSI (s) (F4!24) [15:45:05:965]: PROPERTY CHANGE: Modifying INSTALLDIR property. Its current value is 'C:\Program Files\SplunkUniversalForwarder'. Its new value: 'C:\Program Files\SplunkUniversalForwarder\'.
GetPreviousSettings: Info: previous install location: C:\Program Files\SplunkUniversalForwarder\
GetPreviousSettings: Info: User account is LocalSystem
GetPreviousSettings: Info: found installed splunk products:
MSI (s) (F4!24) [15:45:05:969]: PROPERTY CHANGE: Modifying DoNotInstallDrivers property. Its current value is '0'. Its new value: '1'.
GetPreviousSettings: Info: ProductCode: {1F0EA823-12FF-4298-9C82-FCD86CABD59B}, ProductName: UniversalForwarder, ProductVersion: 8.1.6.0
GetPreviousSettings: Info: skip installing drivers. To override this setting use FORCEINSTALLDRIVERS=1
GetPreviousSettings: Info: Number of splunk products installed: 1
GetPreviousSettings: Info: Leave GetPreviousSettings: 0x0.
MSI (s) (F4:A0) [15:45:05:973]: Doing action: CheckSameProdCodeExists
MSI (s) (F4:A0) [15:45:05:973]: Note: 1: 2205 2: 3: ActionText
Action ended 15:45:05: GetPreviousSettings. Return value 1.
Action start 15:45:05: CheckSameProdCodeExists.
MSI (s) (F4:A0) [15:45:05:974]: Note: 1: 2205 2: 3: Error
MSI (s) (F4:A0) [15:45:05:974]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1709
MSI (s) (F4:A0) [15:45:05:974]: Product: UniversalForwarder -- This version of UniversalForwarder has already been installed on this computer.

Action ended 15:45:05: CheckSameProdCodeExists. Return value 3.
Action ended 15:45:05: INSTALL. Return value 3.
MSI (s) (F4:A0) [15:45:05:977]: Note: 1: 1729
MSI (s) (F4:A0) [15:45:05:977]: Note: 1: 2205 2: 3: Error
MSI (s) (F4:A0) [15:45:05:977]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1729
MSI (s) (F4:A0) [15:45:05:977]: Note: 1: 2205 2: 3: Error
MSI (s) (F4:A0) [15:45:05:977]: Note: 1: 2228 2: 3: Error 4: SELECT Message FROM Error WHERE Error = 1709
MSI (s) (F4:A0) [15:45:05:977]: Product: UniversalForwarder -- Configuration failed.

MSI (s) (F4:A0) [15:45:05:978]: Windows Installer reconfigured the product. Product Name: UniversalForwarder. Product Version: 8.1.6.0. Product Language: 1033. Manufacturer: Splunk, Inc.. Reconfiguration success or error status: 1603.

MSI (s) (F4:A0) [15:45:05:980]: Deferring clean up of packages/files, if any exist
MSI (s) (F4:A0) [15:45:05:980]: MainEngineThread is returning 1603
MSI (s) (F4:20) [15:45:05:980]: No System Restore sequence number for this installation.
=== Logging stopped: 11/18/2021 15:45:05 ===
MSI (s) (F4:20) [15:45:05:983]: User policy value 'DisableRollback' is 0
MSI (s) (F4:20) [15:45:05:983]: Machine policy value 'DisableRollback' is 0
MSI (s) (F4:20) [15:45:05:983]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (F4:20) [15:45:05:983]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (F4:20) [15:45:05:983]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (F4:20) [15:45:05:984]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (F4:20) [15:45:05:984]: Destroying RemoteAPI object.
MSI (s) (F4:5C) [15:45:05:984]: Custom Action Manager thread ending.
MSI (c) (AC:E4) [15:45:05:986]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (AC:E4) [15:45:05:986]: MainEngineThread is returning 1603
=== Verbose logging stopped: 11/18/2021 15:45:05 ===

Answer 2

Apparently there is an issue on the testing...
echo query done %OS%
if "%OS%" == "32BIT" Goto Run32
if "%OS%" == "64BIT" Goto Run64
echo goto failed
echo %OS%
pause
:Run64
echo run64
pause

---

it never goes to Run64

C:\Windows\system32>echo query done %OS%
query done 64BIT

C:\Windows\system32>if "%OS%" == "32BIT" Goto Run32

C:\Windows\system32>if "%OS%" == "64BIT" Goto Run64

C:\Windows\system32>echo goto failed
goto failed

C:\Windows\system32>echo %OS%
64BIT

C:\Windows\system32>pause
Press any key to continue . . .

C:\Windows\system32>

---

Answer 3

Thanks for the information.
Now all deployments installed the Application...
The remaining issue now if that the process remains "In Progress" in the CM Console ....

Checking the Detection ...
Any log(s) for these steps which should be after the installation...

Thanks,
Dom

Answer 4

The Application is installed so there is no issue with the download as it is installed it could be with the verification it is installed... it is just pending... I was checking once an hour and suddenly checking after 9 hours and everything is green...

Really strange ...

Thanks,
Dom

Answer 5

ConfigMgr is not real time and sometimes compliance can take a while to update. Was the deployment over Internet?