Installation of section win64 failed

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

We are unable to deploy many/most probes to Windows Servers.

We receive a message like: "Installation of section win64 failed"

The controller log on the target machine shows errors like the following:

Aug  1 05:04:15:745 [4572] 0 Controller: inst_file_next: Unable to append to file robot/pkg/temp/vs2017_vcredist_x64.exe.tmp 

The filename may be different but in all cases, a .dll or .exe is involved.

Environment

• Release: UIM 20.4
• OS: Windows 

Cause

• MsSense.exe
• This is related to Windows Defender Advanced Threat Protection (formerly known as Windows Defender Endpoint.)
• Exclusions for realtime scanning should be generated for the UIM installation folder.  The realtime scans interfere with the ability of UIM to transmit these files.

Resolution

Using Procmon tool you should be able to identify MsSense.exe is blocking the files.

This is related to Windows Defender ATP

https://strontic.github.io/xcyclopedia/library/MsSense.exe-D87379B55F5CDF0E4B5EB8E498729C77.html 

 

Customer's Windows/Security team needs to address this and set exclusions following the below wiki.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-server-exclusions-microsoft-defender-antivirus?view=o365-worldwide 

Additional Information

UIM and Antivirus

• The OPLOCK means that MsSense.exe has put a lock on the file so that it can scan it, without being interrupted.
• It is actually this lock that is the main cause of the issue. SUCCESS means it was able to successfully scan it. 
• But by this time, the OPLOCK has prevented the file from being updated which is why we need to exclude this from the realtime scans.

Another solution:
Defender\Add-MpPreference -ExclusionPath "C:\Program Files (x86)\Nimsoft"