4 Replies Latest reply on Feb 18, 2011 4:25 PM by clbarnett

    Agent upgrade fails on Windows 2008 R2

    pschmehl

      Had a strange one today.  A lead tech was setting up a new VM running WIndows 2008 R2.  He installed the agent and starting doing other things, expecting the agent to install everything else.  It didn't, so he contacted me.  I RDP'd into the server and tried to launch the Agent Monitor from an administrator command window but I got an error message.  The agent wasn't working.  So I ran the install again.  Agent installed and started contacting the ePO server for policies and tasks.  As soon as it started updating the patch level of the agent, it stopped working again.

       

      I was able to get the install to work by running it as administrator.  After that the agent functioned normally, installed and updated all the software, including the agent, and began reporting in normally.

       

      I assume this is something related to UAC, but this is different behavior for me.  Normally I run the install, get the ubiquitous UAC prompt, click on Yes or Allow and everything works as expected.  In this case that didn't work.  I had to launch the installer as administrator.

       

      Is this normal behavior for 2008 R2?  Or is there something funky about UAC on this box?

        • 1. Agent upgrade fails on Windows 2008 R2

          This is what I have seen for 2008 R2 and Windows 7.  If you don't run the Agent install as an administrator (right click and Run as Administrator) you get wierd results - even if your user is an administrator.  One other thing I have noticed is that if you log in as the local administrator in 2008 R2 there is no split token - you are an administrator.  It has helped me in other software installs to just log on as the local admin.  Hope this helps.

          1 of 1 people found this helpful
          • 2. Agent upgrade fails on Windows 2008 R2
            pschmehl

            Interesting.  I haven't had this problem with Windows 7, only 2008 R2.

            • 3. Agent upgrade fails on Windows 2008 R2

              It could be that because we are running the FramePkg with impersonation it always needs permission elevation.  We have it set to run as a domain account that is an administrator on all the systems.  I do know that if the system is not part of the domain it won't install and that is actually what we want.  We have a lot of venders and contractors that connect to our network and we don't want to install ePO on systems that are not ours.

              • 4. Agent upgrade fails on Windows 2008 R2

                Sounds like UAC is causing problems. In local security policy, check Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account

                 

                By default, this is set to 'Disabled'.  This means that the built-in Administrator account does not run with the same User Account Control (UAC) policy as other administrators.  This is probably why jataylor has noticed that logging in as local administrator sometimes helps with installs.

                 

                You can test if it's UAC causing the issue by setting Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode to Disabled.  That setting basically switches UAC off.  Don't leave it this way, just change it temporarily to prove that the install fails with UAC on and works with UAC off.

                1 of 1 people found this helpful