Try to remove safe-t

1

hi, try to remove this program

image
image946×27 2.08 KB

this is the registry i found

image
image1803×1009 31.6 KB

with this command

wait “{pathname of system folder & “\msiexec.exe”}” /x {{1DF4A1EC09141FE48A39D75CF160E5AD} /qn

and its failed

this is the logs

Current Date: June 25, 2024
Client version 11.0.2.125 built for WINVER 10.0 i386 running on WINVER 10.0.19045 x86_64
Current Balance Settings: Use CPU: True Entitlement: 0 WorkIdle: 10 SleepIdle: 480
IP Address 0: 10.40.4.137
IP Address 1: 192.168.62.1
IP Address 2: 192.168.134.1
IP Address 3: fe80:0:0:0:b0a6:d955:96.151.64.148%2
IP Address 4: fe80:0:0:0:bce1:4666:191.251.76.154%14
IP Address 5: fe80:0:0:0:e791:2427:94.131.36.83%7
Host name: AVIVF-2266
Computer ID: 10272205
Executable Location: C:\Program Files (x86)\BigFix Enterprise\BES Client\BESClient.exe
File Log Location: C:\Program Files (x86)\BigFix Enterprise\BES Client__BESData__Global\Logs
ICU 73.2 init status: SUCCESS
Agent internal character set: UTF-8
ICU report character set: UTF-8 - Transcoding Disabled
ICU fxf character set: windows-1255 (Hebrew) - Transcoding Enabled
ICU local character set: windows-1255 (Hebrew) - Transcoding Enabled

At 03:57:47 +0300 -
Beginning Relay Select
At 03:58:00 +0300 -
RegisterOnce: Attempting secure registration with ‘https://172.16.10.10:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.2.125&Body=10272205&SequenceNumber=3932&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MinHops=4&MaxHops=4&Root=http://BFMain.Mivtachim.co.il%3A52311&AdapterInfo=dc-4a-3e-8c-26-af_10.40.4.0%2F24_10.40.4.137_0&AdapterInfo=00-50-56-c0-00-01_192.168.62.0%2F24_192.168.62.1_0&AdapterInfo=00-50-56-c0-00-08_192.168.134.0%2F24_192.168.134.1_0&AdapterIpv6=dc-4a-3e-8c-26-af^fe80%3A%3Ab0a6%3Ad955%3A6097%3A4094%2F64_0&AdapterIpv6=00-50-56-c0-00-01^fe80%3A%3Abce1%3A4666%3Abffb%3A4c9a%2F64_0&AdapterIpv6=00-50-56-c0-00-08^fe80%3A%3Ae791%3A2427%3A5e83%3A2453%2F64_0’
Unrestricted mode
Configuring listener without wake-on-lan
Registered with url ‘https://172.16.10.10:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.2.125&Body=10272205&SequenceNumber=3932&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MinHops=4&MaxHops=4&Root=http://BFMain.Mivtachim.co.il%3A52311&AdapterInfo=dc-4a-3e-8c-26-af_10.40.4.0%2F24_10.40.4.137_0&AdapterInfo=00-50-56-c0-00-01_192.168.62.0%2F24_192.168.62.1_0&AdapterInfo=00-50-56-c0-00-08_192.168.134.0%2F24_192.168.134.1_0&AdapterIpv6=dc-4a-3e-8c-26-af^fe80%3A%3Ab0a6%3Ad955%3A6097%3A4094%2F64_0&AdapterIpv6=00-50-56-c0-00-01^fe80%3A%3Abce1%3A4666%3Abffb%3A4c9a%2F64_0&AdapterIpv6=00-50-56-c0-00-08^fe80%3A%3Ae791%3A2427%3A5e83%3A2453%2F64_0’
Registration Server version 11.0.2.125 , Relay version 11.0.2.125
Relay does not require authentication.
Client has an AuthenticationCertificate
Relay selected: 172_16_10_10.Mivtachim.co.il. at: 172.16.10.10:52311 on: IPV4 (Using setting OnlyIPV4)
At 03:58:33 +0300 -
[ThreadTime:03:58:00] ShutdownListener
[ThreadTime:03:58:00] SetupListener success: IPV4
At 05:02:57 +0300 -
Report posted successfully
At 06:03:59 +0300 -
ActiveDirectory: Refreshed Computer Information - Domain: MVTAPPL
At 09:30:44 +0300 -
Successful Synchronization with site ‘BigFix Reports’ (version 1) - ‘http://sync.bigfix.com/cgi-bin/bfgather/bigfixreports’
At 09:38:01 +0300 -
Beginning Relay Select
At 09:38:08 +0300 -
RegisterOnce: Attempting secure registration with ‘https://172.16.10.10:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.2.125&Body=10272205&SequenceNumber=3933&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MinHops=4&MaxHops=4&Root=http://BFMain.Mivtachim.co.il%3A52311&AdapterInfo=dc-4a-3e-8c-26-af_10.40.4.0%2F24_10.40.4.137_0&AdapterInfo=00-50-56-c0-00-01_192.168.62.0%2F24_192.168.62.1_0&AdapterInfo=00-50-56-c0-00-08_192.168.134.0%2F24_192.168.134.1_0&AdapterIpv6=dc-4a-3e-8c-26-af^fe80%3A%3Ab0a6%3Ad955%3A6097%3A4094%2F64_0&AdapterIpv6=00-50-56-c0-00-01^fe80%3A%3Abce1%3A4666%3Abffb%3A4c9a%2F64_0&AdapterIpv6=00-50-56-c0-00-08^fe80%3A%3Ae791%3A2427%3A5e83%3A2453%2F64_0’
Unrestricted mode
Configuring listener without wake-on-lan
Registered with url ‘https://172.16.10.10:52311/cgi-bin/bfenterprise/clientregister.exe?RequestType=RegisterMe60&ClientVersion=11.0.2.125&Body=10272205&SequenceNumber=3933&MinRelayVersion=7.1.1.0&CanHandleMVPings=1&MinHops=4&MaxHops=4&Root=http://BFMain.Mivtachim.co.il%3A52311&AdapterInfo=dc-4a-3e-8c-26-af_10.40.4.0%2F24_10.40.4.137_0&AdapterInfo=00-50-56-c0-00-01_192.168.62.0%2F24_192.168.62.1_0&AdapterInfo=00-50-56-c0-00-08_192.168.134.0%2F24_192.168.134.1_0&AdapterIpv6=dc-4a-3e-8c-26-af^fe80%3A%3Ab0a6%3Ad955%3A6097%3A4094%2F64_0&AdapterIpv6=00-50-56-c0-00-01^fe80%3A%3Abce1%3A4666%3Abffb%3A4c9a%2F64_0&AdapterIpv6=00-50-56-c0-00-08^fe80%3A%3Ae791%3A2427%3A5e83%3A2453%2F64_0’
Registration Server version 11.0.2.125 , Relay version 11.0.2.125
Relay does not require authentication.
Client has an AuthenticationCertificate
Relay selected: 172_16_10_10.Mivtachim.co.il. at: 172.16.10.10:52311 on: IPV4 (Using setting OnlyIPV4)
At 09:38:36 +0300 -
[ThreadTime:09:38:08] ShutdownListener
[ThreadTime:09:38:08] SetupListener success: IPV4
At 10:24:56 +0300 -
GatherActionMV command received. Version difference, gathering action site.
At 10:25:17 +0300 - actionsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite)
Downloaded ‘http://172.16.10.10:52311/bfmirror/bfsites/manydirlists_1/__diffsite_87ad39987ef21a553537f4d6609a17d28c92a6e8_to_3c26682ae6598f0f7d9f89412a56aa9140795631’ as ‘__TempUpdateFilename’
At 10:25:27 +0300 - actionsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite)
Gather::SyncSiteByFile adding files - count: 1
At 10:25:31 +0300 -
Successful Synchronization with site ‘actionsite’ (version 31704) - ‘http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite’
At 10:25:56 +0300 - actionsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite)
Relevant - Remove SafeT (fixlet:27239)
At 10:30:45 +0300 -
Report posted successfully
At 10:41:19 +0300 -
GatherHashMV command received.
At 10:41:22 +0300 - mailboxsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/mailboxsite10272205)
Downloaded ‘http://172.16.10.10:52311/mailbox/files/57/b9/57b915ee1894a7252d4d6006d900451844c3e584’ as ‘Action 27241.fxf’
Gather::SyncSiteByFile adding files - count: 1
At 10:41:24 +0300 -
Successful Synchronization with site ‘mailboxsite’ (version 88) - ‘http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/mailboxsite10272205’
Processing action site.
At 10:41:42 +0300 - mailboxsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/mailboxsite10272205)
Relevant - Remove SafeT (fixlet:27241)
At 10:41:42 +0300 -
ActionLogMessage: (action:27241) Action signature verified for Execution
ActionLogMessage: (action:27241) starting action
At 10:41:42 +0300 - actionsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite)
Command started - wait “C:\WINDOWS\system32\msiexec.exe” /x {1DF4A1EC09141FE48A39D75CF160E5AD} /qn (action:27241)
At 10:42:04 +0300 -
Report posted successfully
At 10:42:04 +0300 - actionsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/actionsite)
Command succeeded (Exit Code=1619) wait “C:\WINDOWS\system32\msiexec.exe” /x {1DF4A1EC09141FE48A39D75CF160E5AD} /qn (action:27241)
At 10:42:04 +0300 -
ActionLogMessage: (action:27241) ending action
At 10:42:04 +0300 - mailboxsite (http://BFMain.Mivtachim.co.il:52311/cgi-bin/bfgather.exe/mailboxsite10272205)
Not Relevant - Remove SafeT (fixlet:27241)
At 10:45:04 +0300 -
Report posted successfully

any one have idea?,10x

2

As a rule of thumb - before trying to automate anything from BigFix you should try the command manually on machines; respectively, if there are any failures from BigFix the first troubleshooting step should be to test to command on the machine it failed. BigFix can only run what you have configured but if the command fails there is nothing it can do…

In this particular case your action is running the correct command but the command itself is failing with standard MSI Installer exit code 1619 (MSI Installer/Exec Error codes) but those are not always very descriptive. You are going to have to try it manually to see the actual error message and whether it has any suggestions on how to resolve it. If not, google the error message you do get from the manual run - chances are you are not the first facing it but all in all, it’s a machine/OS/application issue, not a BigFix one…

2 Likes
3

I’d also try disabling 32-bit redirection, since the service would use the 32-bit msiexec by default.

Add

Action uses wow64 redirection false

Before the ‘waithidden’ command.

1 Like