topic Re: Splunk UF fail to install on Windows Server in Deployment Architecture

Splunk UF fail to install on Windows Server

HexalNull — Wed, 15 Apr 2026 15:45:03 GMT

Hi All,

I’m facing an issue while installing the Splunk Universal Forwarder on my Windows server using the MSI command.

From the installation logs I extracted (see below), it appears that the installer fails and rolls back because it is unable to install the regmon driver. Is there a way to exclude the installation of the regmon driver when running the MSI installer?

MSI (s) (24:C8) [12:22:57:569]: Hello, I'm your 64bit Elevated Non-remapped custom action server.
InstallRegmonDrv: Warning: Invalid property ignored: FailCA=.
InstallRegmonDrv: Info: Driver inf file: D:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf.
InstallRegmonDrv: Info: Enter. Args: rundll32.exe, setupapi,InstallHinfSection DefaultInstall 128 D:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf
InstallRegmonDrv: Info: SystemPath is: C:\Windows\system32\
InstallRegmonDrv: Info: Execute string: C:\Windows\system32\cmd.exe /c "C:\Windows\system32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 128 D:\Program Files\SplunkUniversalForwarder\bin\splunkdrv.inf >> "C:\Users\PDCC07~1.RAD\AppData\Local\Temp\splunk.log" 2>&1"
InstallRegmonDrv: Error: Failed to create process : 0x5
InstallRegmonDrv: Warning: Failed to install regmon driver.
InstallRegmonDrv: Error 0x80004005: Cannot install regmon driver.
CustomAction InstallRegmonDrv returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (24:38) [12:22:57:673]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (24:38) [12:22:57:674]: User policy value 'DisableRollback' is 0
MSI (s) (24:38) [12:22:57:674]: Machine policy value 'DisableRollback' is 0
Action ended 12:22:57: InstallFinalize. Return value 3.
MSI (s) (24:38) [12:22:57:692]: Note: 1: 2318 2:
MSI (s) (24:38) [12:22:57:697]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1552900824,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (24:38) [12:22:57:697]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (24:38) [12:22:57:697]: Executing op: DialogInfo(Type=1,Argument=UniversalForwarder)
MSI (s) (24:38) [12:22:57:698]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back

Re: Splunk UF fail to install on Windows Server

isoutamo — Wed, 15 Apr 2026 16:43:12 GMT

Are you installing this with admininstrator right or just with your own?

Re: Splunk UF fail to install on Windows Server

kknairr — Wed, 15 Apr 2026 17:29:01 GMT

@HexalNull Try running the MSI with admin privileges using Run as administrator option to see if it solves the issue.

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: Splunk UF fail to install on Windows Server

HexalNull — Thu, 16 Apr 2026 01:08:10 GMT

Hi,

It's ran under the admin privilleage, we have checked through the logs, installation are going well except when it reach the regmon installation where the process hit with an exit error code "CreateProcess 0x5" and the whole installation got roll back.

Re: Splunk UF fail to install on Windows Server

HexalNull — Thu, 16 Apr 2026 01:08:35 GMT

Hi,

It's with admin privilleage.

Re: Splunk UF fail to install on Windows Server

livehybrid — Thu, 16 Apr 2026 03:29:07 GMT

Hi @HexalNull

What version are you installing? I have seen this issue on10.0.2 which causes this access denied issue (based on 'MSI (s) (24:38) [12:22:57:673]: Note: 1: 2265 2: 3: -2147287035')

If you are using 10.0.2 or lower please could you try again with the most recent version?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk UF fail to install on Windows Server

HexalNull — Thu, 16 Apr 2026 03:32:53 GMT

Hi @livehybrid ,

Am running version 9.2.1 due to legacy OS windows 2016

Re: Splunk UF fail to install on Windows Server

kknairr — Thu, 16 Apr 2026 06:13:41 GMT

@HexalNull That's the catch. You are running a legacy OS and the Splunk UF version you are installing might not be compatible with Windows server 2016.

Please refer the below article published and try the resolution mentioned.

You could try version 9.2.9 and see if it succeeds the installation.

Solution:

Windows Server 2016 Not Supported for Splunk Enterprise 9.2 and Higher (Including Splunk 10) | Splunk

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: Splunk UF fail to install on Windows Server

livehybrid — Thu, 16 Apr 2026 12:09:23 GMT

Hi @HexalNull

In that case I would recommend trying an upgrade to 9.3.11 which was released 2 weeks ago and should have the fix in.

https://download.splunk.com/products/universalforwarder/releases/9.3.11/windows/splunkforwarder-9.3.11-0c8d350423a0-x64-release.msi

Version > 9.3.7 and < 9.4.0 does support Windows 2016 based on the docs at https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.3/plan-your-splunk-enterprise-installation/system-requirements-for-use-of-splunk-enterprise-on-premises

Please let me know how you get on!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk UF fail to install on Windows Server

HexalNull — Fri, 17 Apr 2026 09:10:18 GMT

Hi @livehybrid

As that particular pool of servers are running legacy OS 2016 windows. We didn't push beyond the mentioned version in case of compatability issue.

Having said that, we have managed to install 100 plus of the same OS 2016 only a small set of around 20 servers that didn't went through with the mentioned error message.

Was scratching head to figure out what could have potentially went wrong....

Re: Splunk UF fail to install on Windows Server

HexalNull — Fri, 17 Apr 2026 09:11:27 GMT

@kknairr

The strange thing is that we managed to install for 100 + servers of the same build just a small set of around 20 servers that didn't went through with the mentioned error message.

Was scratching head to figure out what could have potentially went wrong....

Re: Splunk UF fail to install on Windows Server

kknairr — Fri, 17 Apr 2026 10:01:07 GMT

@HexalNull When only a subset fails, the issue is usually environmental rather than compatibility. You could check system differences like any hardened policies that could interfere with the installer. Check for any Group policy restrictions or UAC settings. You could also try installing the suggested versions to those failed servers to see how it goes as well.

If this post addressed your question, you can:

Give it karma to show appreciation 👍
Mark it as the solution if it solved your issue ✔️
Add a comment if you’d like more details ✏️

Acknowledging helpful answers keeps the community strong and motivates contributors to continue sharing their expertise.

Re: Splunk UF fail to install on Windows Server

livehybrid — Fri, 17 Apr 2026 19:24:06 GMT

Hi @HexalNull

Given that the error you're getting is Access Denied (0x80030005) [represented as decimal] it does sound like it could be a local policy/permission error or that Splunk UF is trying to access something on the failing host which is perhaps not present or configured differently on the others? Is this possible in your environment?

Are you able to try 9.3.11 to see if the issue has been fixed by Splunk as a bug?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Splunk UF fail to install on Windows Server

isoutamo — Fri, 17 Apr 2026 22:12:19 GMT

Have you found any common baseline for those failing servers? Like DC or other special purpose servers?
Are there any local host based FW or network shares or disks in use? Anything what is different than those servers where install has succeeded?