Carbon Black Cloud: Install Fails on Machine Managed By SCCM

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Install of Carbon Black Cloud Sensor fails
• This error may show in verbose MSI log (/L*vx)

  CA:InstallPreCheck:  Error 0x8000ffff: Expect a cfg.ini in the same directory as the MSI, but cound not find it.

• Old Sensor Versions may be referenced in verbose MSI log
• Entries in verbose MSI log may reference ccmcache as installer source

  MSI (s) (XX:XX) [XX:XX:XX:XXX]: SOURCEMGMT: Trying source C:\Windows\ccmcache\

Environment

• Carbon Black Cloud Sensor (formerly CB Defense): All Versions
• Microsoft Windows: All Supported Versions
• SCCM configured and managing clients
• Carbon Black Cloud Sensor (formerly CB Defense) was previously deployed and successfully uninstalled

Cause

If SCCM was not configured to allow upgrades, SCCM will create registry keys on the client that will prevent installation of new CB Defense versions.

Resolution

1. Backup registry prior to edits
2. Locate the following registry key

   HKEY_CLASSES_ROOT\Installer\Products\{CB Defense GUID}

3. Delete the registry key
4. Perform install as usual to resolve issue
5. Check SCCM configuration to ensure ability to allow upgrades

Additional Information

• The {CB Defense GUID} is a string of characters randomly generated for each new sensor install. This is different from the MSI GUID. The value can be found via an elevated command prompt

reg query HKEY_CLASSES_ROOT\Installer\Products\ /s /f "Cb Defense Sensor"

• For newer sensors (3.5 and higher)

reg query HKEY_CLASSES_ROOT\Installer\Products\ /s /f "Carbon Black Cloud Sensor"

• It may be necessary to review all entries in HKEY_CLASSES_ROOT\Installer\Products\ to ensure there are not multiple entries for Carbon Black Cloud/Cb Defense
• This issue can happen if SCCM Configuration Manager is configured with detection rule: "This MSI product code must exist on the target system to indicate the presence of this application"
• This issue will occur on any machines with this registry key in place, even if Carbon Black Cloud/Cb Defense has been uninstalled