Cannot upgrade sensor due to missing msi installer file
search cancel

Cannot upgrade sensor due to missing msi installer file

book

Article ID: 292413

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Endpoint Standard Carbon Black Cloud Enterprise EDR Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Sensor upgrade fails from console and locally
  • Msi install.log shows the failure is during uninstall of previous version

Environment

  • Endpoint Standard Sensor: 3.5 through 3.6
  • Microsoft Windows: All Supported Versions

Cause

  • Windows Application event logs 
    • Log Name: Application
Source: MsiInstaller
Event ID: 11714
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Description:
Product: Carbon Black Cloud Sensor 64-bit -- Error 1714. The older version of Carbon Black Cloud Sensor 64-bit cannot be removed. Contact your technical support group. System Error 1612.
  • msi install.log 
    • Info 1603.The file C:\Program Files\Confer\scanner\scanhost.exe is being held in use by the following process: Name: scanhost, Id: 4112, Window Title: '(not determined yet)'. Close that application and retry.
Action ended 11:01:46: InstallValidate. Return value 1.
Action start 11:01:46: RemoveExistingProducts.
CustomAction returned actual error code 1612 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (E4:68) [11:01:46:448]: Product: Carbon Black Cloud Sensor 64-bit -- Error 1714. The older version of Carbon Black Cloud Sensor 64-bit cannot be removed. Contact your technical support group. System Error 1612.
Error 1714. The older version of Carbon Black Cloud Sensor 64-bit cannot be removed. Contact your technical support group. System Error 1612.
Action ended 11:01:46: RemoveExistingProducts. Return value 3.

Resolution

This issue is fixed in later versions of the sensor. As a workaround to get to a fixed version

  1. Open regedit and search for "Carbon Black Cloud" under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\" registry
  2. This will find a registry value like "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\<CB Sensor Product Code>\InstallProperties" with a reg value called "LocalPackage"
  3. The key value is the name of the msi installer in the "C:\windows\Installer" folder. This folder will not be present at this point
  4. Perform the same steps on an endpoint with the same sensor version installed. The name of the msi installer may differ
  5. Copy the msi installer from the endpoint in step 4 to the affect endpoint into C:\windows\Installer with a name that matches the value obtained in step 3 

If a copy of the MSI files can not be located please open a case where we can provide you either with the installer or the installer files 

Additional Information

  • Issue may occur when the server has received a Windows update since the last install
  • The actual code seen in step 2 by the customer will vary depending on the product code of the build used
  • The "Installer" folder is not directly visible under "C:\Windows", the path can be accessed by directly typing the path in explorer
Powered by Wolken Software