1 Reply Latest reply on Nov 19, 2009 4:30 PM by RMCCULLO

    Problem deploying RSD on Win 2000 Server

      Hi,

      We have a Windows 2000 Server which is running SP4 and is fully patched that we use as a rogue sensor on one of our networks.

      We've recently upgraded from ePo 4.0 to 4.5 and tried deploying the new sensor to the Win 2000 system, but it fails to install. The package downloads fine via the agent and the install runs, but then seems to roll itself back once it runs 'RSSensor.exe --install' after unpacking everything.

      This is from the agent log:
      Updater 12/10/2009 12:20:25 Info Update Finished
      Updater 12/10/2009 12:20:25 Info Error occurred while installing SNOWCAP_2000.
      Updater 12/10/2009 12:20:18 Info Verifying Setup.ini.
      Updater 12/10/2009 12:20:18 Info Verifying Setup.exe.
      Updater 12/10/2009 12:20:17 Info Verifying RSDSensr.cab.
      Updater 12/10/2009 12:20:17 Info Verifying RSDSensor.msi.
      Updater 12/10/2009 12:20:17 Info Verifying RSDSensor.exe.Org.
      Updater 12/10/2009 12:20:17 Info Verifying RSDSensor.exe.
      Updater 12/10/2009 12:20:17 Info Verifying instmsiw.exe.
      Updater 12/10/2009 12:20:17 Info Verifying 0x0409.ini.
      Updater 12/10/2009 12:20:17 Info Installing SNOWCAP_2000.

      This seems to be the relevant data from the install log:

      MFETRACE: registerOurServices: Running the following command for the sensor install: "C:\Program Files\McAfee\RSD Sensor\RSSensor.exe" --install
      MFETRACE: registerOurServices: executeCommand returned code 128
      MSI (s) (50:E4) [12:20:23:109]: User policy value 'DisableRollback' is 0
      MSI (s) (50:E4) [12:20:23:109]: Machine policy value 'DisableRollback' is 0
      Action ended 12:20:23: InstallFinalize. Return value 3.
      MSI (s) (50:E4) [12:20:23:109]: Executing op: Header(Signature=1397708873,Version=301,Timestamp=994861708,LangId=1033,Platform=0,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
      MSI (s) (50:E4) [12:20:23:109]: Executing op: DialogInfo(Type=0,Argument=1033)
      MSI (s) (50:E4) [12:20:23:109]: Executing op: DialogInfo(Type=1,Argument=McAfee Rogue System Detection Sensor)
      MSI (s) (50:E4) [12:20:23:109]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
      MSI (s) (50:E4) [12:20:23:109]: Executing op: ActionStart(Name=registerOurServices,,)
      MSI (s) (50:E4) [12:20:23:109]: Executing op: ProductInfo(ProductKey={34C22C5D-30F8-4EF4-97CF-0A8594F42959},ProductName=McAfee Rogue System Detection Sensor,PackageName=RSDSensor.msi,Language=1033,Version=67436544,Assignment=1,ObsoleteArg=0,ProductIcon=ARPPRODUCTICON.exe,,PackageCode={F7C68A50-7E2F-4F85-86FE-98EBF9678EA5},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0)
      MSI (s) (50:E4) [12:20:23:125]: Executing op: ActionStart(Name=unregisterOurServicesRollback,,)
      MSI (s) (50:E4) [12:20:23:125]: Executing op: CustomActionRollback(Action=unregisterOurServicesRollback,ActionType=3393,Source=BinaryData,Target=unregisterOurServices,)
      MSI (s) (50:94) [12:20:23:125]: Invoking remote custom action. DLL: C:\WINNT\Installer\MSI43.tmp, Entrypoint: unregisterOurServices
      MFETRACE: unregisterOurServices: Entered Immediate.Dll unregisterOurServices function.
      MFETRACE: unregisterOurServices: Stopping the RSSensor service so Plugin can be unloaded.
      MFETRACE: Entering stopOurService for service RSSensor.
      MFETRACE: Uninstalling Registry key is now set.
      MFETRACE: The service RSSensor does not exist or is already marked for deletion so skip trying to stop it.
      MFETRACE: Service RSSensor is now stopped.
      MFETRACE: unregisterOurServices: Registry key found for "Applications Plugins".
      MFETRACE: unregisterOurServices: Registry key found for "Installed Path".
      MFETRACE: unregisterOurServices: Running the following command for the sensor uninstall: "C:\Program Files\McAfee\RSD Sensor\RSSensor.exe" --uninstall
      MFETRACE: unregisterOurServices: executeCommand returned code 128
      MSI (s) (50:E4) [12:20:23:171]: Executing op: ActionStart(Name=LoadProductPlugin,,)
      MSI (s) (50:E4) [12:20:23:171]: Executing op: ActionStart(Name=UnloadProductPluginRollback,,)
      MSI (s) (50:E4) [12:20:23:187]: Executing op: CustomActionRollback(Action=UnloadProductPluginRollback,ActionType=3393,Source=BinaryData,Target=UnloadProductPlugin,)
      MSI (s) (50:94) [12:20:23:187]: Invoking remote custom action. DLL: C:\WINNT\Installer\MSI44.tmp, Entrypoint: UnloadProductPlugin
      MFETRACE: UnloadProductPlugin: Entered Immediate.Dll UnloadProductPlugin function.
      MFETRACE: UnloadProductPlugin: Stopping the RSSensor service so Plugin can be unloaded.
      MFETRACE: Entering stopOurService for service RSSensor.
      MFETRACE: Uninstalling Registry key is now set.
      MFETRACE: The service RSSensor does not exist or is already marked for deletion so skip trying to stop it.
      MFETRACE: Service RSSensor is now stopped.
      MFETRACE: UnloadProductPlugin: Loading NagShr32.Dll from the following location: C:\Program Files\McAfee\Common Framework\nagshr32.dll
      MFETRACE: UnloadProductPlugin: NagShr32.Dll loaded successfully. Calling GetProcAddress to load UnloadPluginDLL.
      MFETRACE: UnloadProductPlugin: GetProcAddress successfull. Calling UnloadPluginDLL (SNOWCAP_2000).
      MFETRACE: UnloadProductPlugin: UnloadPluginDLL (SNOWCAP_2000) successfull.
      MSI (s) (50:E4) [12:20:23:234]: Executing op: ActionStart(Name=WaitForPlugInToUnloadRollback,,)
      MSI (s) (50:E4) [12:20:23:234]: Executing op: CustomActionRollback(Action=WaitForPlugInToUnloadRollback,ActionType=3393,Source=BinaryData,Target=WaitForPlugInToUnload,)
      MSI (s) (50:98) [12:20:23:234]: Invoking remote custom action. DLL: C:\WINNT\Installer\MSI45.tmp, Entrypoint: WaitForPlugInToUnload
      MFETRACE: WaitForPlugInToUnload: Entered Immediate.Dll WaitForPlugInToUnload function.
      MFETRACE: WaitForPlugInToUnload: "Applications Plugins" Registry key found for the SNOWCAP_2000 product.
      MFETRACE: WaitForPlugInToUnload: "Plugin Path" Registry key found for the SNOWCAP_2000 product.
      MFETRACE: WaitForPlugInToUnload: Plugin file is NOT busy so exiting function.


      We raised this with McAfee a couple of weeks ago now (and sent them level 8 output from MER tool) and they've come up with nothing.

      Anyone have any ideas what the problem might be, or how to work around it? The documentation states Windows 2000 is supported, but maybe this is incorrect...
        • 1. Re: Problem deploying RSD on Win 2000 Server
          RMCCULLO

          Looks like the uninstall sees that the sensor was already trying to remove. What I cannot tell from the logs, is what it is waiting on to remove the service.

           

          I beleive that a Reboot of the system may be in order to unregister the service, but to double check this, I would look at the Windows PendingFileRename Reg key, to see if our files are listed here.