How to do a Silent install for PSB 12.01?

Nizzon
Nizzon W/ Alumni Posts: 10 Security Scout
in WithSecure Elements Endpoint Protection

So Im trying to deploy PSB 12.01 silently in a Config Manager Task Sequence but the installer ends with exit code 1. It times out waiting for some process to end.

 

Trying the iinstallation "manually" through cmd with silent switch and there are no real clues, logbook says something about "Software Protection Service has stopped"  and  "VVS service timeout due to inactivity".

 

What are the correct switches for this version to do a silent install that ends with success code 0?

 

Its not the first time im looking for information like this I have to say that F-secure is really bad at documenting this kind of information.

Comments

  • RobertoSilvaChu
    RobertoSilvaChu W/ Alumni Posts: 33 Junior Protector

    Hi!

     

    To remote installation you will need check some items:

     

    • Rights for Installation: The installation account must have sufficient rights (must be a local administrator or domain);
    • Enable the Remote Registry service on the clients (To enable the Remote Registry service go to Control Panel -> Administrative Tools -> Services -> Remote Registry)
      To verify that the remote registry on a machine is activated on remote machines, open Regedit.
      In regedit, go to File -> Connect Network Registry
      Enter the name of the remote machine. If you still do not see the remote registry is because the machine is locked the Remote Registry option in your service. You need to enable it.
    • Try to access the admin $ share drive on the end-user
    • Windows Firewall must be disabled in service to the client, to avoid blocking network traffic.
    • Policy Manager and workstation must be on the same network.
    • Check the following protocols in stations are enabled:
      RPC (TCP 135)
      NetBIOS (137-139) and
      SMB (TCP port 445) on your firewall
    • On the client, go to the Control Panel-> Administrative Tools> Local Security policies> Policies- Local> Security Options - Network Access: Sharing and security model for local accounts, check the configuration.

    pms_push.JPG

    To SILENT installation, dont forget uncheck the Display progress indicator to end-users during the remote installation.

     

    Best Regards,

     

    Roberto Chu

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    I dont have a Policy Manager for Protection For Business. I have the F-secure PSB Portal, the only thing I can do is to download the package from there.

     

    I can deploy version 10.0 and 10.50 silently. But 12.01 doesnt work. 

  • RobertoSilvaChu
    RobertoSilvaChu W/ Alumni Posts: 33 Junior Protector

    Ops, sorry for this wrong answer.

     

    Are you using this tool for PSB remote install?

    http://download.sp.f-secure.com/protection_service/remote-installation-tool-1.00.17617-win32-hotfix1.zip

    Its important the check list where I said in the last post is working in the end-user such as:

    • Registry remote service is working;
    • RPC/NetBios/ SMB ports is avaible;
    • Another instructions where already said the last post.

    Another solution is install a Policy Manager Server/Console in a machine and import the .JAR to this server and do the remote install by Policy Manager. So this way, you will proceed as Policy Manager normal install (so just use the previous post the check list install).

    http://download.sp.f-secure.com//protection_service/fspsbwks-12.01.283_PSB1.jar

     

    Best Regards,

     

    Roberto Chu

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    No we are deploying Windows 7 and F-secure with Microsoft System Center Configuration Manager and the F-secure installation should be done unattended together with the OS installation in the Task Sequence. We should not be forced to use a separate tool for this.

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    Looks like I finally cracked this **bleep**. Smiley Happy

     

    • On CM Application - Run installation as 32-bit process on 64-bit clients 
    • In CM Task Sequence choose Continue on Error
    • Put a Restart Computer-step right after the install-step

     

    Again...

    We should not have to deal with these kinds of problems, this is a workaround. It is not the first time we encounter these problems with your packages. It is not much to ask for a package that can be installed silently without errors.

  • compfreak
    compfreak W/ Alumni Posts: 3 Security Scout

    I'm also having problems when trying to deploy FSCS 12.0 from an exported MSI file via policy manager. We are deploy using Specops software, but that should't matter as all MSI are supposed to do the same thing. Is there any documentation on parameters available for your MSI you get exported from Policy Manager ?

     

    For me, the installation goes well in the meaning of error code, but there is only a post created in Windows Remove/add program saying FSCS is installed. But I never see FSCS starting on the client computer, not even after several reboots. You should be able to provide us with an adminguide on deploy F-Secure products, like the one for Policy Manager that's out there.

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader

    Hello compfreak,

     

    In the upcoming CS 12.10 release we make significant improvements for MSI installation scenarios.

    CS 12.10 RTM is planned for mid of June. CS 12.10 Admin guide will contain the information about supported MSI installation scenarios, options, etc...

    Currently CS 12.10 Beta3 is available with MSI related changes in place, and you can try it already now.

     

    Best regards,

    Vad

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    Do F-secure not support a silent install of PSB?

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader

    Hello Nizzon,

     

    If we are talking about installation from exe package, here is the standard example of command line which provides silent installation and returns 0:

     

    fspsbwks-12.01.283_PSB1.exe /SILENT /VARS : DISABLE_REBOOT=true /LANG:ENG /K:XXXX-XXXX-XXXX-XXXX-XXXX

     

    Best regards,

    Vad

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    Ok, well if you read this thread it is not working like it should.

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader

    Unfortunately, information in your posts is not enough to figure out why this command doesn't work properly in your case. Please, contact support. We'll need more information for investigation.

     

    Thanks in advance,

    Vad

  • Nizzon
    Nizzon W/ Alumni Posts: 10 Security Scout

    You know what? I called F-secure support three times and everytime my call was dropped, so I gave up.

    I have a F-secure support contact at ATEA Sweden but he cant help and reffers to F-secure Support.

  • Ben
    Ben W/ Alumni Posts: 664 Cybercrime Crusader

    Hello Nizzon,

     

    Sorry to hear that you couldn't reach our support by phone.
    Can you confirm the number you use?

    This page show the contact number and service hours.

    You can always send us a request through our webform here.

  • compfreak
    compfreak W/ Alumni Posts: 3 Security Scout

    Hi Vad,

     

    Where can I get this CS 12.10 Beta3? Is it a .JAR file that I can build with my policys from Policy Manager and finally export a working MSI from? Trying to download from your site only give me the base CS 12.00.

     

    One thing that odd, my fist question aboute CS 12.00 not installing proppertly... I've found that sometimes if I let my develop VM idle it will start to install all the products on the machine. Before with CS 11 this install was made instantly after running MSI.  Notice sometimes... I've left it over the weekend and still just having the one F-secure post in Programs and features.

     

    Is it so that you redesigned the MSI to just drop a policy agent on the machine that later on continue the real installation of all products? (As I only see "F-Secure Client Security 12.00" in Programs and features at a beginning.)

    If that's the case, is there a switch to force full install immediately? I'm not so happy with removing our old CS 11, and then let the agent decide when it's time to install CS12 leaving our machines unprotected during that time.

     

    2016-05-23 10-24-48.png

     

    Or am I doing something wrong?

    Running on Windows 7 x64.

     

    Thanks.

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader

    Hello compfreak,

     

    Regarding MSI installation logic. Since CS 11.61 there was a change. MSI itself only launches the installation and completes, while installation is continuing in the background. In CS 12.10 the behavior by default returned to the same we had in versions 11.60 and earlier, and you can provide additional options in command line.

     

    Note that for MSI installation having a single entry in Programs and features is by design. All the features are installed, and you can check this in Policy Manager Console.

     

    Here are the links for CS 12.10 Beta3 Premium/Standard jar and release notes:

    https://download.f-secure.com/corpro/cs/upcoming/fscspr-12.10.453-beta3.jar

    https://download.f-secure.com/corpro/cs/upcoming/fscs-12.10.453-beta3.jar
    https://download.f-secure.com/corpro/cs/upcoming/fscs-12.10-beta3-release-notes.html  

     

    You will also need a new PM version 12.10:

    https://download.f-secure.com/corpro/pm/upcoming/fspm-12.10.75922-beta3.exe

    https://download.f-secure.com/corpro/pm/upcoming/fspm-12.10-beta3-release-notes.html

     

    Regards,

    Vad

     

     

     

  • compfreak
    compfreak W/ Alumni Posts: 3 Security Scout

    Thank's for the clarification on the installing process. Could be a problem with the uninstall from MSI that makes my installs hang intermittent. I've found another thread (Silent-uninstall-F-Secure-PSP) with a solution to run the uninstallation tool instead. Seams to do the trick as now I can reproduce the same results every time and continue the deploy process with successful results.

     

    If I'm going to try the CS 12.10 Beta3, and run this new PM 12.10 Beta3, the PM wont collide with our current client's running on CS 11.61?

     

    Thanks.

  • Vad
    Vad W/ Alumni Posts: 1,069 Cybercrime Crusader

    PM 12.10 Beta3 supports all currently supported products versions, including CS 11.61.

     

    Best regards,

    Vad

  • etomcat
    etomcat W/ Alumni Posts: 1,172 Firewall Master

    Dear Sirs,

     

    Several customers complain that the F-Secure PSB remote installation tool is so ancient, it is unable to properly support Active Directory domain data read-out, when the server is Win 2012 R2 or newer. They only receive a remote API code 2 127 (2127?) error message.

     

    Yours Sincerely: Tamas Feher, 2F 2000 Kft., Hungary.

     

    ********************************-

     

    kiraly_endre_hiba.png

This discussion has been closed.

Categories