Seger Steele 0 Posted August 14, 2023 Share Posted August 14, 2023 Happy Monday! I've been having a issue where some users are having the software uninstall task fail within ESET Protect. The software we're uninstalling is ESET Endpoint Security, the fails have happened for both macOS and Windows. While troubleshooting, I found this ESET forum post that mentioned checking the software-uninstall.logs for errors related to the uninstall being password protected, I pulled the software-uninstall.log from the agent logs immediately after a failed attempt, output is below. Any ideas on where to go next? C:\ProgramData\ESET\RemoteAdministrator\Agent\EraAgentApplicationData\Logs> cat software-uninstall.log === Verbose logging started: 8/14/2023 14:20:23 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\WINDOWS\system32\msiexec.exe MSI (c) (8C:7C) [14:20:23:601]: Resetting cached policy values MSI (c) (8C:7C) [14:20:23:601]: Machine policy value 'Debug' is 0 MSI (c) (8C:7C) [14:20:23:602]: ******* RunEngine: ******* Product: {EF6D6B44-84A1-4455-A81B-91F00E912CD7} ******* Action: ******* CommandLine: ********** MSI (c) (8C:7C) [14:20:23:602]: Client-side and UI is none or basic: Running entire install on the server. MSI (c) (8C:7C) [14:20:23:603]: Grabbed execution mutex. MSI (c) (8C:7C) [14:20:23:691]: Cloaking enabled. MSI (c) (8C:7C) [14:20:23:692]: Attempting to enable all disabled privileges before calling Install on Server MSI (c) (8C:7C) [14:20:23:694]: Incrementing counter to disable shutdown. Counter after increment: 0 MSI (s) (E8:74) [14:20:23:702]: Running installation inside multi-package transaction {EF6D6B44-84A1-4455-A81B-91F00E912CD7} MSI (s) (E8:74) [14:20:23:702]: Grabbed execution mutex. MSI (s) (E8:B0) [14:20:23:707]: Resetting cached policy values MSI (s) (E8:B0) [14:20:23:707]: Machine policy value 'Debug' is 0 MSI (s) (E8:B0) [14:20:23:707]: ******* RunEngine: ******* Product: {EF6D6B44-84A1-4455-A81B-91F00E912CD7} ******* Action: ******* CommandLine: ********** MSI (s) (E8:B0) [14:20:23:708]: Machine policy value 'DisableUserInstalls' is 0 MSI (s) (E8:B0) [14:20:23:712]: Note: 1: 2203 2: C:\WINDOWS\Installer\inprogressinstallinfo.ipi 3: -2147287038 MSI (s) (E8:B0) [14:20:23:718]: SRSetRestorePoint skipped for this transaction. MSI (s) (E8:B0) [14:20:23:720]: MSCOREE not loaded loading copy from system32 MSI (s) (E8:B0) [14:20:23:756]: End dialog not enabled MSI (s) (E8:B0) [14:20:23:757]: Original package ==> C:\Windows\Installer\3d917.msi MSI (s) (E8:B0) [14:20:23:757]: Package we're running from ==> C:\Windows\Installer\3d917.msi MSI (s) (E8:B0) [14:20:23:758]: APPCOMPAT: Uninstall Flags override found. MSI (s) (E8:B0) [14:20:23:759]: APPCOMPAT: Uninstall VersionNT override found. MSI (s) (E8:B0) [14:20:23:759]: APPCOMPAT: Uninstall ServicePackLevel override found. MSI (s) (E8:B0) [14:20:23:760]: APPCOMPAT: looking for appcompat database entry with ProductCode '{EF6D6B44-84A1-4455-A81B-91F00E912CD7}'. MSI (s) (E8:B0) [14:20:23:762]: APPCOMPAT: no matching ProductCode found in database. MSI (s) (E8:B0) [14:20:23:768]: Machine policy value 'DisablePatch' is 0 MSI (s) (E8:B0) [14:20:23:768]: Machine policy value 'AllowLockdownPatch' is 0 MSI (s) (E8:B0) [14:20:23:769]: Machine policy value 'DisableLUAPatching' is 0 MSI (s) (E8:B0) [14:20:23:769]: Machine policy value 'DisableFlyWeightPatching' is 0 MSI (s) (E8:B0) [14:20:23:770]: Looking for file transform: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst MSI (s) (E8:B0) [14:20:23:770]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer 3: 2 MSI (s) (E8:B0) [14:20:23:778]: File will have security applied from OpCode. MSI (s) (E8:B0) [14:20:23:780]: Original transform ==> C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst MSI (s) (E8:B0) [14:20:23:781]: Transform we're running from ==> C:\WINDOWS\Installer\eaa219.mst MSI (s) (E8:B0) [14:20:23:781]: SOFTWARE RESTRICTION POLICY: Verifying transform --> 'C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst' against software restriction policy MSI (s) (E8:B0) [14:20:23:783]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst has a digital signature MSI (s) (E8:B0) [14:20:23:783]: SOFTWARE RESTRICTION POLICY: C:\ProgramData\ESET\ESET Security\Installer\fix_norepair.mst is permitted to run because the user token authorizes execution (system or service token). MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2205 2: 3: Patch MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2205 2: 3: PatchPackage MSI (s) (E8:B0) [14:20:23:784]: Note: 1: 2262 2: _Tables 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: _Columns 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: Media 3: -2147287038 MSI (s) (E8:B0) [14:20:23:785]: Note: 1: 2262 2: File 3: -2147287038 MSI (s) (E8:B0) [14:20:23:786]: TRANSFORM: 'PatchPackage' table is missing or empty. No pre-transform fixup necessary. MSI (s) (E8:B0) [14:20:23:786]: TRANSFORM: Applying regular transform to database. MSI (s) (E8:B0) [14:20:23:786]: Note: 1: 2262 2: _Tables 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Columns 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Config 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: Binary 3: -2147287038 MSI (s) (E8:B0) [14:20:23:787]: Note: 1: 2262 2: _Validation 3: -2147287038 MSI (s) (E8:B0) [14:20:23:788]: Note: 1: 2262 2: ActionText 3: -2147287038 MSI (s) (E8:B0) [14:20:23:788]: Note: 1: Link to comment Share on other sites More sharing options...
Administrators Marcos 5,143 Posted August 14, 2023 Administrators Share Posted August 14, 2023 I assume the log is incomplete. Please raise a support ticket and provide the whole log file for perusal. Link to comment Share on other sites More sharing options...
Seger Steele 0 Posted August 14, 2023 Author Share Posted August 14, 2023 @Marcos Thanks for the quick reply, is there a link you could shoot me towards for entering this support ticket? Link to comment Share on other sites More sharing options...
Seger Steele 0 Posted August 14, 2023 Author Share Posted August 14, 2023 @Marcos I found it! Disregard above, thanks Link to comment Share on other sites More sharing options...
mrac 5 Posted August 14, 2023 Share Posted August 14, 2023 Since 10.1 all uninstall tasks are failing (macOS and Windows) several seconds after start. In 10.0 and older versions of ESET Protect they worked in ~70% runs. Didn't open ticket, had no time, thought it is known issue... Link to comment Share on other sites More sharing options...
Administrators Marcos 5,143 Posted August 15, 2023 Administrators Share Posted August 15, 2023 6 hours ago, mrac said: Since 10.1 all uninstall tasks are failing (macOS and Windows) several seconds after start. In 10.0 and older versions of ESET Protect they worked in ~70% runs. Didn't open ticket, had no time, thought it is known issue... It's not a known issue. Please raise a support ticket for further investigation. Link to comment Share on other sites More sharing options...
Seger Steele 0 Posted August 15, 2023 Author Share Posted August 15, 2023 Submitted a ticket, ticket is #00624951. Link to comment Share on other sites More sharing options...
Solution Seger Steele 0 Posted August 16, 2023 Author Solution Share Posted August 16, 2023 After looking through the software-uninstall.log file, we had a policy that was enforcing password protected uninstalls. Removing the policy fixed us up incase anyone comes here wondering the same. Link to comment Share on other sites More sharing options...
Recommended Posts