Installation of vCenter Server 6.0 Appliance Client integration plugin fails

Products

• VMware vCenter Server

Issue/Introduction

Installation of the vCenter Server 6.0 Appliance Client Integration Plugin fails with the following error:

Error overwriting hosts file: boost::filesystem::copy_file: Access is denied: "C:\Windows\System32\drivers\etc\hosts.new", "C:\Windows\System32\drivers\etc\hosts\"

Environment

VMware vCenter Server 6.0.x

Cause

The vCenter Server 6.0 Appliance Client Integration plugin edits the Windows System hosts file to add the following entries:

127.0.0.1 vmware-localhost
::1 vmware-localhost

These entries are used by the deployment wizard as it creates a secure web sockets using the address wss://vmware-localhost:port/

Some Antivirus applications can prevent unauthorized modifications of the Windows System hosts file.

VMware has tested internally using McAfee and Avast Antivirus solutions.

Resolution

Temporarily Disable the Antivirus application:

1. Disable your Antivirus application.
2. Install the vCenter Server 6.0 Appliance Client Integration Plugin
3. Enable your Antivirus application.

Note: The changes made to the Windows System hosts file are reverted on uninstall of the Client Integration Plug and you may need to also disable Antivirus when performing an uninstall.

Additional Information

 

Impact/Risks:

Symantec Endpoint Protection or any other equivalent application has an 'Application Control' rule that can be enabled called 'Block Modifications to hosts file'. When this setting is enabled within Endpoint Protection Manager, disabling the Symantec Endpoint Protection Client is insufficient. All attempts to overwrite or modify the hosts file will fail. Even if you modify NTFS permissions and try and take ownership of the file etc. You can either completely uninstall the client (not recommended) or you can modify the Application Control Policy and disable the setting preventing modification. Once this settings is disabled and the policy applied against the relevant user / group, open the SEP client and select 'Update Policy'. Once the updated policy is applied you don't need to disable the SEP Client for the installation to complete successfully.