Agent Install or Upgrade Fails Due to Failed to Start Service Error[1053]

Products

• Carbon Black App Control

Issue/Introduction

During installation or upgrade, the attempt fails with the following seen in the log:

Service[3]: Successfully opened a handle to Service[PARITY]

Service[3]: Closing service handle

Service[3]: Successfully opened a handle to Service[PARITY]

Service[6]: Service State[1:Stopped] Pid[0] ControlsAccepted[00000000] WaitHint[0] ExitCode[0 (0)] Checkpoint[0] ServiceFlags[00000000] Type[00000010]

Property[CustomActionData] Value[;C:\Program Files (x86)\Bit9\Parity Agent\]

DisableLSP - WSCSetApplicationCategory succeeded

DisableLSP - WSCSetApplicationCategory succeeded

Service[6]: Service State[1:Stopped] Pid[0] ControlsAccepted[00000000] WaitHint[0] ExitCode[0 (0)] Checkpoint[0] ServiceFlags[00000000] Type[00000010]

Attempting to start the service[PARITY]

Service[1]: Failed to start service Error[1053]

Error: Failed to start the service[PARITY], Error[1053]

Service[3]: Closing service handle

Environment

• App Control Agent: 8.10.0+
• Microsoft Defender SmartScreen: Enable

Cause

Microsoft Defender SmartScreen is preventing final installation steps of the App Control Agent which results in a service start failure.

Resolution

1. Temporarily disable Microsoft Defender SmartScreen.
2. Install or upgrade the Agent.
3. Enable Microsoft Defender SmartScreen.

Additional Information

If the issue persists:

1. Use an administrative command prompt to enable SmartScreen Debugging:

   wevtutil sl Microsoft-Windows-SmartScreen/Debug /e:true

2. Start a Standard Procmon Capture.
3. Initiate the Agent Upgrade or Agent Install manually using an administrative command prompt.
4. After the failure
   1. Stop the Procmon and export all Events as a PML.
   2. Collect the Agent Upgrade or Install log generated.
   3. Collect Event Viewer Logs for
      • Application
      • System
      • SmartScreen
5. Zip all collected files
6. Revert the SmartScreen Debugging:

   wevtutil sl Microsoft-Windows-SmartScreen/Debug /e:false

7. Open a case with Support and provide the resulting files.