cosmos's community posts

We tried to deply 7.0.0.3 via an MSI. The result is that:
* the majority of the systems are stuck. 7.0.0.3 does not start, there is no service
* around 30% of the systems took the upgrade ok

We have been running around with this since morning. Something is seriously borked with the MSI, as produced by the online wizard.

Ι uninstalled 7.0.0.3 and reinstalled 6.10. Again I tried to install 7.0.0.3 without disabling ESET at all. And this time installation was successful! I've opened ticket #4080 for the case.

An update.

On a fresh Windows 10 install, with ESET endpoint running, installing (as domain admin manually, by msiexec /i file.msi /qn) a custom msi using the online wizard, produced the following:
* 7.0.0.3 host seems installed
* No ru host service exists
* The following were logged under %programdata%\remote utilities\install.txt

12-04-2021_12:05:18#T:SilentInstall: installation 69110
12-04-2021_12:05:18#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
12-04-2021_12:05:18#T:SilentInstall: OpenService: service not found. OK
12-04-2021_12:05:18#T:SilentInstall: CreateService. OK
12-04-2021_12:05:18#T:SilentInstall: finished
12-04-2021_13:34:55#T:SilentInstall: uninstallation 69110
12-04-2021_13:34:55#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
12-04-2021_13:34:55#T:SilentInstall: service found, removing
12-04-2021_13:34:57#T:SilentInstall: installation 70003
12-04-2021_13:34:57#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
12-04-2021_13:34:57#T:SilentInstall: service found, removing
12-04-2021_13:34:58#T:SilentInstall: finished

This is quite similar to what I saw in my previous post. There's something I do not understand though: why is the installer removing the service, right after installation of 70003 has started? Essentially considering that there is a service to remove!

If I understand your log correctly, the 69110 service was removed at 13:34:55. Between that time and 13:34:57 obviously a service was installed and subsequently deleted. It's not as though as an error that came up. It's as if the installer decided to roll back for some reason.

Is there some way I can enable a debug output here?

Polina wrote:

Hello,

Thank you for the provided log.

It seems like the issue might have been caused by ESET's activity as their antivirus currently detects and removes our custom Host/Agent packages by blocking our current signature. Here's a related thread on this. We're currently discussing this with the ESET team in order to resolve the issue as soon as possible.

In order to confirm the above, please try using a vanilla MSI Host package downloaded from our website, specify it as your MSI package in the Remote Install Tool and see if remote Host is updated properly this way.

Please let me know if this worked for you.

I've used the wizard-created custom MSI on one of our hosts, after disabling all ESET endpoint security features. This time it went fine. However, I still don't feel confident for a wide deployment via GPO. I'm not certain this was caused by ESET. If it wasn't then another cause should be searched. Even if it was, I still have a problem here, since I can't simply disable ESET over our fleet...

Polina, I'm having the same issue on the viewer.

Is your fix going to involve only the viewer or the host as well? I'm currently postponing installation of Host 7.0.0.3 due to the problems discussed in my other thread, this would be an extra issue to wait for a more definite resolution.

The install.log was still there:

26-03-2021_12:48:03#T:SilentInstall: installation 69110
26-03-2021_12:48:03#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
26-03-2021_12:48:03#T:SilentInstall: OpenService: service not found. OK
26-03-2021_12:48:03#T:SilentInstall: CreateService. OK
26-03-2021_12:48:03#T:SilentInstall: finished
31-03-2021_12:36:03#T:SilentInstall: uninstallation 69110
31-03-2021_12:36:03#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
31-03-2021_12:36:03#T:SilentInstall: service found, removing
31-03-2021_12:36:05#T:SilentInstall: installation 70003
31-03-2021_12:36:05#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
31-03-2021_12:36:05#T:SilentInstall: service found, removing
31-03-2021_12:36:06#T:SilentInstall: finished
31-03-2021_12:50:34#T:SilentInstall: uninstallation 70003
31-03-2021_12:50:34#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
31-03-2021_12:50:34#T:SilentInstall: OpenService: service not found. OK
31-03-2021_12:50:34#T:SilentInstall: finished
31-03-2021_12:51:31#T:SilentInstall: installation 69110
31-03-2021_12:51:31#T:SilentInstall: NTSetPrivilege:SE_DEBUG_NAME:false. OK
31-03-2021_12:51:31#T:SilentInstall: OpenService: service not found. OK
31-03-2021_12:51:31#T:SilentInstall: CreateService. OK
31-03-2021_12:51:31#T:SilentInstall: finished

I tried to upgrade on March 31st. Antivirus running is ESET Endpoint Security 8, centrally managed, with its own firewall module disabled (the Windows 10 firewall is enabled). No security-related events were logged on the same day or today.

I'll have to reproduce this issue, since I've reverted to 6.10 on that system. Will try again over the coming days, but gathering data and reporting is seriously taxing my time...

I tried your advice and created a new MSI using the online configurator. I skipped the settings regarding setting an internet id and in the next step I selected to change only the settings that include the language. I only selected Greek there and I did not sel ect any other setting.

On a Windows 10 system with a 6.10 host and internet-id enabled I opened an admin cmd prompt and ran the installer using

msiexec /i RUT.7.0.0.3.msi /qn

. I wanted to simulate installation via a GPO. I saw that the host icon disappeared fr om the tray. Additionally, under add/remove programs RU host 7.0.0.3 was listed.

I rebooted, but the RU icon did not come up. Checking at the services, there is no "Remote Utilities - Host" service listed. Trying to "Start host" from programs does nothing.

Ideas?

Thank you for your helpful comments. I'll try your advice and get back to you.

Thank you for creating a Greek translation. It's quality is great as well!

There's a minor spell error: when the viewer is offered to retrieve a license key from RU Relay, two options are offered basically, either accept or skip the step altogether. Skip has been translated as Παράληψη which means to forget something. The correct term is Παράλειψη.

Like I said, just a small thingy to fix at a later stage :)