Carbon Black Defense Installation Issues

I have a bit of a predicament.

I have downloaded the msi installer and have tested the install script on machines locally using the following command: msiexec /q /i “C:\Windows\Temp\installer_vista_win7_win8-64-3.4.0.1047.msi” /L* log.txt COMPANY_CODE=“XXXXXXXXXXXX”

However, when I reference the .bat file using:

run “C:\Windows\Temp\CarbonBlackDefense.bat”

The .bat file references the above command which has been tested and works without issue…I think I am missing something very simple.

This does not work. I have the other CB products working perfect using the same method of referencing a .bat file in the local C:\Windows\Temp directory, just not this one. I have tried putting it in the downloads folder and that doesn’t seem to work either.

Any logs you could share?

Absolutely. I will as soon as I get back to my workstation. It seems to succeed in the Client logs and report back not relevant but the status is ‘failed’ in the action status and the sensor isn’t installed. Following the exact same method for the other corresponding CB sensor and it installs without issue. Just pulling my (what’s left of it) hair out with this.

Is there a reason you’re leveraging a batch file to call msiexec?

Why not try something like:

waithidden msiexec.exe /q /i __Download\installer_vista_win7_win8-64-3.4.0.1047.msi /L* "{pathname of windows folder & "\temp\cbdefense.log"}" COMPANY_CODE={parameter "company_code" of action}

1 Like

Also it may be failing because the Bigfix client runs programs in 32-bit mode by default. Before running the installer, try switching the client into native mode with the actionscript command

action uses wow64 redirection false

When I tried that previously it would generate a 1619 exit code. Which pointed to an activation issue with the msi. Which I know is not the case -if I run the install using the same command manually it runs and installs with no issue and then is present in the CB console.

:cough: 32 vs 64-bit

1 Like

This is what I get when adding the redirection, again, it shows successful, but the sensor is not installed.

At 08:57:20 -0400 - mailboxsite (http://XXXX.XXX.com:52311/cgi-bin/bfgather.exe/mailboxsite5412921)
Relevant - CBDefense::Install Sensor (fixlet:123544)
At 08:57:21 -0400 -
ActionLogMessage: (action:123544) Action signature verified for Execution
ActionLogMessage: (action:123544) starting action
At 08:57:21 -0400 - actionsite (http://xxxxxx.xxx.com:52311/cgi-bin/bfgather.exe/actionsite)
Wow64 redirection disabled. action uses wow64 redirection false (action:123544)
Command succeeded run “C:\Windows\Temp\CarbonBlackDefenseInstall.bat” (action:123544)
At 08:57:21 -0400 -
ActionLogMessage: (action:123544) ending action
At 08:57:21 -0400 - mailboxsite (http://xxxxxx.xxxx.com:52311/cgi-bin/bfgather.exe/mailboxsite5412921)
Not Relevant - CBDefense::Install Sensor (fixlet:123544)
At 08:57:48 -0400 -
Report posted successfully

Does anything come out of the log output you configured on your MSI command?

Would you mind pasting your entire actionscript?

An an exit code of 1619 in this case might mean that the MSI location was incorrectly referenced.

From https://docs.microsoft.com/en-us/windows/win32/msi/error-codes, note the following:

ERROR_INSTALL_PACKAGE_OPEN_FAILED 1619 This installation package could not be opened. Verify that the package exists and is accessible, or contact the application vendor to verify that this is a valid Windows Installer package.

roperty(S): UserLanguageID = 1033
Property(S): ComputerName = WHQTEC20
Property(S): SystemLanguageID = 1033
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 23
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 9:21:00
Property(S): Date = 8/16/2019
Property(S): MsiNetAssemblySupport = 4.7.3190.0
Property(S): MsiWin32AssemblySupport = 6.3.17763.1
Property(S): RedirectedDllSupport = 2
Property(S): USERNAME = XXXXXXX
Property(S): COMPANYNAME = XXXXX
Property(S): DATABASE = C:\windows\Installer\3dd876.msi
Property(S): OriginalDatabase = C:\Windows\Temp\installer_vista_win7_win8-64-3.4.0.1047.msi
Property(S): UILevel = 2
Property(S): ACTION = INSTALL
MSI (s) (EC:EC) [09:21:00:689]: Product: Cb Defense Sensor 64-bit – Installation failed.

MSI (s) (EC:EC) [09:21:00:689]: Windows Installer installed the product. Product Name: Cb Defense Sensor 64-bit. Product Version: 3.4.0.1047. Product Language: 1033. Manufacturer: Carbon Black, Inc… Installation success or error status: 1603.

=== Logging stopped: 8/16/2019 9:21:00 ===

I have kicked this to CB support as well.

prefetch installer_vista_win7_win8-64-3.4.0.1047.msi sha1:47346aeb19d139b69961727e7fd1c6be00bf665b size:30035968 http://xxxxxxxx.xxxx.com:52311/Uploads/installer_vista_win7_win8-64-3.4.0.1047.msi
waithidden msiexec.exe /q /i __Download\installer_vista_win7_win8-64-3.4.0.1047.msi /L* COMPANY_CODE=“xxxxxx”

This was what CB support sugggested. However, this also fails with an exit code of 1622.

At 10:19:04 -0400 -
ActionLogMessage: (action:123549) Non-Distributed - DownloadsAvailable
ActionLogMessage: (action:123549) Action signature verified for Execution
ActionLogMessage: (action:123549) starting action
At 10:19:05 -0400 - actionsite (http://xxxxxx.xxxx.com:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Prefetch download manager collected file) prefetch installer_vista_win7_win8-64-3.4.0.1047.msi sha1:47346aeb19d139b69961727e7fd1c6be00bf665b size:30035968 http://xxxxxxx.xxxx.com:52311/Uploads/installer_vista_win7_win8-64-3.4.0.1047.msi (action:123549)
Command started - waithidden msiexec.exe /q /i __Download\installer_vista_win7_win8-64-3.4.0.1047.msi /L* COMPANY_CODE=“xxxxxx” (action:123549)
Command succeeded (Exit Code=1622) waithidden msiexec.exe /q /i __Download\installer_vista_win7_win8-64-3.4.0.1047.msi /L* COMPANY_CODE=“xxxxxxx” (action:123549)
At 10:19:05 -0400 -
ActionLogMessage: (action:123549) ending action
At 10:19:05 -0400 - mailboxsite (http://xxxxxx.xxxx.com:52311/cgi-bin/bfgather.exe/mailboxsite5412921)
Not Relevant - CBDefense::Install Sensor (fixlet:123549)
At 10:21:07 -0400 -
Report posted successfully

What really is driving me nuts is the .BAT process I referenced originally was working 3 days ago without issue.

Return code 1622:
Error opening installation log file. Verify that the specified log file location exists and that you can write to it.

1 Like

Good catch @trn.

So there are a lot of variations that you’re trying, let’s do them one at a time.

You’re switching between ‘waithidden’ and ‘run’. Only use ‘waithidden’, because the action doesn’t wait for ‘run’ to complete before moving on, it may start processing another action while the installer is still running and clear the download folder.

On the line where you used ‘waithidden msiexec.exe’, you did not turn off wow64 redirection and didn’t supply the logfile.txt parameter to the msiexec command.

So - try it this way

  • turn off wow64 redirection
  • use the ‘waithidden msiexec.exe’ command line
  • include the logfile path parameter in the msiexec command line

So for reference, the CBResponse sensor installation using the .bat files works and this is the process it follows. copy “\xxxx.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Defense\installer_vista_win7_win8-64-3.4.0.1047.msi” “C:\Windows\Temp” && copy “\sefcu.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Defense\CarbonBlackDefenseInstall.bat” “C:\Windows\Temp”

The CarbonBlackDefenseInstall.bat command is the following:
msiexec /q /i “C:\Windows\Temp\installer_vista_win7_win8-64-3.4.0.1047.msi” /L* log.txt COMPANY_CODE=“xxxxxxxxxxx”

My action script- which did work was simply run “C:\Windows\Temp\CarbonBlackDefenseInstall.bat”

Now, following the same pattern for the CBResponse sensor (THIS WORKS WITHOUT ISSUE)

copy “\xxx.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Response\cbsetup.msi” “C:\Windows\Temp” && copy “\xxxx.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Response\sensorsettings.ini” “C:\Windows\Temp” && copy “\xxxx.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Response\CarbonBlackClientSetup.exe” “C:\Windows\Temp” && copy “\xxxx.com\sefshare\Apps\DTUpdate\SOFTWARE\SOFTWARE\Carbon Black\Carbon Black Response\CarbonBlackResponseInstall.bat” “C:\Windows\Temp”

The install command for the Response sensor is simple: msiexec /q /i “C:\Windows\Temp\cbsetup.msi” /q

The BigFix Action Script I use to run this (again, 100% success) is this:

run “C:\Windows\Temp\CarbonBlackResponseInstall.bat”

This works without issue, so I am really not sure why the CBDefense sensor, which follows the exact same flow doesnt work when it once did. And I seemingly cannot run it out of “_Download” for whatever reason.

Ok, I now have this as an action script:

prefetch installer_vista_win7_win8-64-3.4.0.1047.msi sha1:47346aeb19d139b69961727e7fd1c6be00bf665b size:30035968 http://xxxxx.xxxx.com:52311/Uploads/installer_vista_win7_win8-64-3.4.0.1047.msi
action uses wow64 redirection false
waithidden msiexec.exe /q /i __Download\installer_vista_win7_win8-64-3.4.0.1047.msi /L* log.txt “C:\Windows\Temp” COMPANY_CODE=“XXXXXXX”

This seems to be in a constant state of “running”

Getting closer then!

It’s likely trying to display some message that isn’t visible to the user desktop. It shouldn’t do that with the ‘/q’ parameter, but an installer package author can override that behavior if they want.

It could have something to do with running under the SYSTEM account rather than a logged-on user account. The easiest way to test for that is

From an elevated command prompt, open a new shell as the SYSTEM account via

Psexec.exe -s -i cmd.exe

This opens a second command prompt as the SYSTEM account. From that new command prompt, try running the full msiexec command line and see whether it installs correctly, or whethet it is stopping to prompt for some message.

So I’m waving the white flag on this issue. Had some other colleagues look at the process and we cannot figure out why even the old .bat process randomly won’t work with BigFix. Truly annoying as we confirmed nothing changed permissions wise that would have caused it to stop working. I am able to launch the command with PSEXEC and nothing prompts me for any sort of interaction.

If you’ve had other attempts before using the ‘run’ command there could still be some setups still executing/stuck - in which case msiexec would stop and give the prompt that ‘there is anothet setup in progress’. Try rebooting?

Ill give that a try. Just very frustrated. We implemented this months ago without issue. And now CB changed something and its near impossible to get to install with BigFix. It shouldnt be this difficult when the vast majority of things in BES are easy enough to figure out. Should I try running CMD.EXE in the action script?