Forum Discussion
ryan666
Oct 10, 2024Copper Contributor
ATP sensor install fails 0x80070643
I am trying to install ATP sensor to all DCS, Federations, CS, and EntraSync servers. All is well on about 70% of them. However I get this failure on many: During installation, I can see bot...
RyanP1895
Nov 07, 2024Copper Contributor
Here are my Sensor logs. Thanks in advance for your help:
[33B4:0FD4][2024-11-06T07:38:31]i001: Burn v3.11.2.4516, Windows v10.0 (Build 14393: Service Pack 0), path: C:\Users\<username>.admin\AppData\Local\Temp\12\{62FFBA84-2319-4871-9784-B5BB33199284}\.cr\Azure ATP Sensor Setup.exe
[33B4:0FD4][2024-11-06T07:38:31]i000: Initializing hidden variable 'AccessKey'
[33B4:0FD4][2024-11-06T07:38:31]i000: Initializing hidden variable 'ProxyConfiguration'
[33B4:0FD4][2024-11-06T07:38:31]i000: Initializing hidden variable 'ProxyUserPassword'
[33B4:0FD4][2024-11-06T07:38:31]i000: Initializing string variable 'NetFrameworkCommandLineArguments' to value '/passive /showrmui'
[33B4:0FD4][2024-11-06T07:38:31]i009: Command Line: '"-burn.clean.room=C:\Temp\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe" -burn.filehandle.attached=484 -burn.filehandle.self=496'
[33B4:0FD4][2024-11-06T07:38:31]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Temp\Azure ATP Sensor Setup\Azure ATP Sensor Setup.exe'
[33B4:0FD4][2024-11-06T07:38:31]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Temp\Azure ATP Sensor Setup\'
[33B4:0FD4][2024-11-06T07:38:33]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\<username>.admin\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20241106073833.log'
[33B4:0FD4][2024-11-06T07:38:33]i000: Setting string variable 'WixBundleName' to value 'Azure Advanced Threat Protection Sensor'
[33B4:0FD4][2024-11-06T07:38:33]i000: Setting string variable 'WixBundleManufacturer' to value 'Microsoft Corporation'
[33B4:0FD4][2024-11-06T07:38:33]i000: Loading managed bootstrapper application.
[33B4:0FD4][2024-11-06T07:38:33]i000: Creating BA thread to run asynchronously.
[33B4:0FD4][2024-11-06T07:38:34]i100: Detect begin, 5 packages
[33B4:0FD4][2024-11-06T07:38:34]i000: 2024-11-06 12:38:34.9321 Debug DeploymentModel DetectDeploymentAction DetectBegin [\[]Installed=False[\]]
[33B4:0FD4][2024-11-06T07:38:34]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_1_for_KB4019990~31bf3856ad364e35~amd64~~6.1.1.2'
[33B4:0FD4][2024-11-06T07:38:34]i000: Setting numeric variable 'Kb4019990Windows2008R2Exists' to value 0
[33B4:0FD4][2024-11-06T07:38:34]i000: Registry key not found. Key = 'SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\Package_1_for_KB4019990~31bf3856ad364e35~amd64~~6.2.1.1'
[33B4:0FD4][2024-11-06T07:38:34]i000: Setting numeric variable 'Kb4019990Windows2012Exists' to value 0
[33B4:0FD4][2024-11-06T07:38:34]i000: Setting string variable 'NetFrameworkRegistryValue' to value '528049'
[33B4:0FD4][2024-11-06T07:38:34]i000: Setting string variable 'ServerLevelsServerCoreRegistryValue' to value '1'
[33B4:0FD4][2024-11-06T07:38:34]i000: Setting string variable 'ServerLevelsServerGuiShellRegistryValue' to value '1'
[33B4:0FD4][2024-11-06T07:38:34]i052: Condition 'Kb4019990Windows2008R2Exists' evaluates to false.
[33B4:0FD4][2024-11-06T07:38:34]i052: Condition 'Kb4019990Windows2012Exists' evaluates to false.
[33B4:0FD4][2024-11-06T07:38:34]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to true.
[33B4:0FD4][2024-11-06T07:38:34]i052: Condition 'NetFrameworkRegistryValue >= 460798' evaluates to true.
[33B4:0FD4][2024-11-06T07:38:34]i101: Detected package: Kb4019990Windows2008R2Package, state: Absent, cached: None
[33B4:0FD4][2024-11-06T07:38:34]i101: Detected package: Kb4019990Windows2012Package, state: Absent, cached: None
[33B4:0FD4][2024-11-06T07:38:34]i101: Detected package: NetFrameworkPackageServer, state: Present, cached: None
[33B4:0FD4][2024-11-06T07:38:34]i101: Detected package: NetFrameworkPackageServerCore, state: Present, cached: None
[33B4:0FD4][2024-11-06T07:38:34]i101: Detected package: MsiPackage, state: Absent, cached: None
[33B4:0FD4][2024-11-06T07:38:34]i199: Detect complete, result: 0x0
[33B4:2B28][2024-11-06T07:38:34]i000: 2024-11-06 12:38:34.9634 Debug DeploymentModel .ctor [\[]DeploymentAction=Install[\]]
[33B4:2B28][2024-11-06T07:38:35]i000: 2024-11-06 12:38:35.1651 Debug DeploymentModel .ctor [\[]IsAfterRestartAndConfigured=False[\]]
[33B4:2B28][2024-11-06T07:39:14]i000: 2024-11-06 12:39:14.2484 Info Model ValidateAsync ValidateCreateSensorAsync returned [\[]validateCreateSensorResult=Success[\]]
[33B4:2B28][2024-11-06T07:39:14]i000: Setting string variable 'IsConfigured' to value 'True'
[33B4:2B28][2024-11-06T07:39:14]i000: Setting hidden variable 'AccessKey'
[33B4:2B28][2024-11-06T07:39:14]i000: Unsetting variable 'DelayedUpdate'
[33B4:2B28][2024-11-06T07:39:14]i000: Unsetting variable 'LogsPath'
[33B4:2B28][2024-11-06T07:39:14]i000: Setting hidden variable 'ProxyConfiguration'
[33B4:2B28][2024-11-06T07:39:14]i000: Setting string variable 'InstallationPath' to value 'C:\Program Files\Azure Advanced Threat Protection Sensor'
[33B4:0FD4][2024-11-06T07:39:14]i200: Plan begin, 5 packages, action: Install
[33B4:0FD4][2024-11-06T07:39:14]i052: Condition 'VersionNT64 = v6.1' evaluates to false.
[33B4:0FD4][2024-11-06T07:39:14]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2008R2Package
[33B4:0FD4][2024-11-06T07:39:14]i052: Condition 'VersionNT64 = v6.2' evaluates to false.
[33B4:0FD4][2024-11-06T07:39:14]w321: Skipping dependency registration on package with no dependency providers: Kb4019990Windows2012Package
[33B4:0FD4][2024-11-06T07:39:14]i052: Condition 'ServerLevelsServerCoreRegistryValue <> 1 OR ServerLevelsServerGuiShellRegistryValue = 1' evaluates to true.
[33B4:0FD4][2024-11-06T07:39:14]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServer
[33B4:0FD4][2024-11-06T07:39:14]i052: Condition 'ServerLevelsServerCoreRegistryValue = 1 AND ServerLevelsServerGuiShellRegistryValue <> 1' evaluates to false.
[33B4:0FD4][2024-11-06T07:39:14]w321: Skipping dependency registration on package with no dependency providers: NetFrameworkPackageServerCore
[33B4:0FD4][2024-11-06T07:39:14]i000: Setting string variable 'WixBundleRollbackLog_MsiPackage' to value 'C:\Users\<username>.admin\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20241106073833_000_MsiPackage_rollback.log'
[33B4:0FD4][2024-11-06T07:39:14]i000: Setting string variable 'WixBundleLog_MsiPackage' to value 'C:\Users\<username>.admin\AppData\Local\Temp\Azure Advanced Threat Protection Sensor_20241106073833_000_MsiPackage.log'
[33B4:0FD4][2024-11-06T07:39:14]i201: Planned package: Kb4019990Windows2008R2Package, state: Absent, default requested: Absent, ba requested: Absent, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[33B4:0FD4][2024-11-06T07:39:14]i201: Planned package: Kb4019990Windows2012Package, state: Absent, default requested: Absent, ba requested: Absent, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[33B4:0FD4][2024-11-06T07:39:14]i201: Planned package: NetFrameworkPackageServer, state: Present, default requested: Present, ba requested: Present, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[33B4:0FD4][2024-11-06T07:39:14]i201: Planned package: NetFrameworkPackageServerCore, state: Present, default requested: Absent, ba requested: Absent, execute: None, rollback: None, cache: No, uncache: No, dependency: None
[33B4:0FD4][2024-11-06T07:39:14]i201: Planned package: MsiPackage, state: Absent, default requested: Present, ba requested: Present, execute: Install, rollback: Uninstall, cache: Yes, uncache: No, dependency: Register
[33B4:0FD4][2024-11-06T07:39:14]i299: Plan complete, result: 0x0
[33B4:0FD4][2024-11-06T07:39:14]i300: Apply begin
[33B4:0FD4][2024-11-06T07:39:14]i010: Launching elevated engine process.
[33B4:0FD4][2024-11-06T07:39:18]i011: Launched elevated engine process.
[33B4:0FD4][2024-11-06T07:39:18]i012: Connected to elevated engine.
[1A3C:22B4][2024-11-06T07:39:18]i358: Pausing automatic updates.
[1A3C:22B4][2024-11-06T07:39:18]i359: Paused automatic updates.
[1A3C:22B4][2024-11-06T07:39:18]i360: Creating a system restore point.
[1A3C:22B4][2024-11-06T07:39:18]i362: System restore disabled, system restore point not created.
[1A3C:22B4][2024-11-06T07:39:18]i370: Session begin, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be359e01-d4fe-4480-a4d8-5d2e68694edd}, options: 0x7, disable resume: No
[1A3C:22B4][2024-11-06T07:39:18]i000: Caching bundle from: 'C:\Users\<username>.admin\AppData\Local\Temp\12\{19CE23F5-1413-432D-9924-FCEADF62B20D}\.be\Azure ATP Sensor Setup.exe' to: 'C:\ProgramData\Package Cache\{be359e01-d4fe-4480-a4d8-5d2e68694edd}\Azure ATP Sensor Setup.exe'
[1A3C:22B4][2024-11-06T07:39:18]i320: Registering bundle dependency provider: {be359e01-d4fe-4480-a4d8-5d2e68694edd}, version: 2.240.18288.55492
[1A3C:22B4][2024-11-06T07:39:18]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be359e01-d4fe-4480-a4d8-5d2e68694edd}, resume: Active, restart initiated: No, disable resume: No
[1A3C:0BF4][2024-11-06T07:39:20]i305: Verified acquired payload: MsiPackage at path: C:\ProgramData\Package Cache\.unverified\MsiPackage, moving to: C:\ProgramData\Package Cache\{3725E0BC-A942-4D76-A0AC-0BF7197CCD26}v2.240.18288.55492\Microsoft.Tri.Sensor.Deployment.Package.msi.
[1A3C:0BF4][2024-11-06T07:39:20]i305: Verified acquired payload: cab9C68882706A1052319FE6C1B5DE23439 at path: C:\ProgramData\Package Cache\.unverified\cab9C68882706A1052319FE6C1B5DE23439, moving to: C:\ProgramData\Package Cache\{3725E0BC-A942-4D76-A0AC-0BF7197CCD26}v2.240.18288.55492\1.
[1A3C:22B4][2024-11-06T07:39:20]i323: Registering package dependency provider: {3725E0BC-A942-4D76-A0AC-0BF7197CCD26}, version: 2.240.18288.55492, package: MsiPackage
[1A3C:22B4][2024-11-06T07:39:21]i301: Applying execute package: MsiPackage, action: Install, path: C:\ProgramData\Package Cache\{3725E0BC-A942-4D76-A0AC-0BF7197CCD26}v2.240.18288.55492\Microsoft.Tri.Sensor.Deployment.Package.msi, arguments: ' ARPSYSTEMCOMPONENT="1" MSIFASTINSTALL="7" ACCESSKEY="*****" DelayedUpdate="" InstallationPath="C:\Program Files\Azure Advanced Threat Protection Sensor" InstalledVersion="" LogsPath="" PROXYCONFIGURATION="*****" WixBundleOriginalSourceFolder="C:\Temp\Azure ATP Sensor Setup\"'
[1A3C:22B4][2024-11-06T07:44:58]e000: Error 0x80070643: Failed to install MSI package.
[1A3C:22B4][2024-11-06T07:44:58]e000: Error 0x80070643: Failed to execute MSI package.
[33B4:0FD4][2024-11-06T07:44:58]e000: Error 0x80070643: Failed to configure per-machine MSI package.
[33B4:0FD4][2024-11-06T07:44:58]i000: 2024-11-06 12:44:58.4738 Error Model LogError [\[]methodName=BootstrapperApplication_ExecutePackageComplete status=-2147023293 exception=[\]]
[33B4:0FD4][2024-11-06T07:44:58]i319: Applied execute package: MsiPackage, result: 0x80070643, restart: None
[33B4:0FD4][2024-11-06T07:44:58]e000: Error 0x80070643: Failed to execute MSI package.
[1A3C:22B4][2024-11-06T07:44:58]i318: Skipped rollback of package: MsiPackage, action: Uninstall, already: Absent
[33B4:0FD4][2024-11-06T07:44:58]i319: Applied rollback package: MsiPackage, result: 0x0, restart: None
[1A3C:22B4][2024-11-06T07:44:58]i329: Removed package dependency provider: {3725E0BC-A942-4D76-A0AC-0BF7197CCD26}, package: MsiPackage
[1A3C:22B4][2024-11-06T07:44:58]i351: Removing cached package: MsiPackage, from path: C:\ProgramData\Package Cache\{3725E0BC-A942-4D76-A0AC-0BF7197CCD26}v2.240.18288.55492\
[1A3C:22B4][2024-11-06T07:44:58]i372: Session end, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be359e01-d4fe-4480-a4d8-5d2e68694edd}, resume: None, restart: None, disable resume: No
[1A3C:22B4][2024-11-06T07:44:58]i330: Removed bundle dependency provider: {be359e01-d4fe-4480-a4d8-5d2e68694edd}
[1A3C:22B4][2024-11-06T07:44:58]i352: Removing cached bundle: {be359e01-d4fe-4480-a4d8-5d2e68694edd}, from path: C:\ProgramData\Package Cache\{be359e01-d4fe-4480-a4d8-5d2e68694edd}\
[1A3C:22B4][2024-11-06T07:44:58]i371: Updating session, registration key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{be359e01-d4fe-4480-a4d8-5d2e68694edd}, resume: None, restart initiated: No, disable resume: No
[33B4:0FD4][2024-11-06T07:44:58]i399: Apply complete, result: 0x80070643, restart: None, ba requested restart: No
[33B4:202C][2024-11-06T14:31:20]i400: Received system request to shut down the process: critical: Yes, elevated: No, allowed: Yes
EliOfek
Microsoft
Nov 07, 2024Thats the depkoyment bootstapper log, not thr sensor log. There should be a another file...