ESET Management Agent still connecting to "localhost" even if right URL is specified

[Mysterycz 0]

Hello,

We have problem with Eset management agent deployment on some computers. I generated install .bat file via eset management console with right settings. Some computers are ok, some are still trying to connect to localhost, which is annoying.

 

2021-05-07 10:55:12 Error: CReplicationModule [Thread 2fd0]: CAgentReplicationManager: Replication finished unsuccessfully with message: InitializeConnection: Initiating replication connection to 'host: "localhost" port: 2222' failed with: GetAuthenticationSessionToken: Failed to fetch device session token in timeReplication details: [Task: CReplicationConsistencyTask, Scenario: Automatic replication (REGULAR), Connection: localhost:2222, Connection established: false, Replication inconsistency detected: false, Server busy state detected: false, Realm change detected: false, Realm uuid: 00000000-0000-0000-0000-000000000000, Sent logs: 0, Cached static objects: 0, Cached static object groups: 0, Static objects to save: 0, Static objects to delete: 0, Modified static objects: 0]
2021-05-07 10:55:25 Error: AuthenticationModule [Thread 2634]: DeviceEnrollmentCommand execution failed with: Request: Era.Common.Services.Authentication.RPCEnrollmentRequest on connection: host: "localhost" port: 2222 with proxy set as: Proxy: Connection: :3128, Credentials: Name: , Password: ******, Enabled:0, EnabledFallback:1, failed with error code: 14, error message: Connect Failed, and error details: 

 

If I check .bat file, there is 

echo.P_CONNECTION_CHOSEN=Host >> "%installConfigFile%"
echo.P_HOSTNAME="CORRECT URL ADDRESS" >> "%installConfigFile%"
echo.P_PORT=2222 >> "%installConfigFile%"

I can ping to eset management URL address OK, also Firewall for domain is turned OFF. 

We have proxy server, but for out domain, all connection is DIRECT.

Can you tell me why agent deployment IGNORE our settings? And fill localhost? 

I also tried to uninstall agent many times. It is fresh new PC.

Thank you in advance.

[Marcos 5,273]

Please try to run the agent live installer with a correct server name in P_HOSTNAME on one of the troublesome machines. Should the problem persist, provide me with the bat file as well as C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs\status.html and trace.log from the machine.

[MartinK 384]

In case nothing would help, I would recommend to check following locations where wrong hostname (localhost) might be located and breaking deployments:

• Hostname might be directly in the installer, i.e. later saved as P_HOSTNAME
• Hostname might be present in configuration policy that was embedded into installer - please double check it
• Hostname might be present in configuration policies assigned to device in console. I would recommend to pass all policies for ESET Management Agent and search for those that are applying hostnames.

[Mysterycz 0]

Hello,

I would like to add, we are using this same installer for many computers, and like 5% are experiencing this "localhost" problem. So I guess hostname should be correct in policy, P_HOSTNAME, etc ...

Logs from problematic computer are in attachments.

I edited this .bat installer to download .MSI from our local fileservers, when I try to install it from official ESET repository, it seems it is OK.

All I changed is URL 
 

set url=\\*.cz\instalace$\ERA\agent_x64.msi

echo.packageLocation = "!url!"

So, there might be problem?

Thank you

ESET logs.rar PROTECTAgentInstallerKopis.rar

[MartinK 384]

Unfortunately I do not see anything suspicious, but I am not sure such modification of installer won't cause problems. From logs from client device, it seems as if configuration was somehow wrong -> especially certificate might be either completely missing, or it just has wrong password. This might be result of script modification, as parameters are passed to AGENT installer in a way, that configuration file install_config.ini (generated by installer script) has to be placed in the same directory, as AGENT installers - and I am not sure this will work in case source of the AGENT installer has been changed -> could you possibly investigate this?