topic Updating Windows UF to 9.2.0.1 via SCCM - 1603 errors in Installation

Updating Windows UF to 9.2.0.1 via SCCM - 1603 errors

whar_garbl — Mon, 18 Mar 2024 19:22:45 GMT

As title. I'm updating to UF 9.2.0.1 via SCCM, but a subset of targets are failing to install the update with the dreaded 1603 return code. The behavior is the same whether or not I run the msi as SYSTEM (i.e., via USE_LOCAL_SYSTEM) or not. All the existing forwarders being updated are newer - 8.2+, but mostly 9.1.x.

Oddly, if I manually run the same msiexec string with a DA account on the local system, the update usually succeeds. It's baking my noodle why it will work one way but not another. I have msiexec debug logging set up, but it's not giving me anything obvious to work with.

I can also usually get it to install if I uninstall the UF and gut the registry of all vestiges of UF, but that's not something I want to do on this many systems.

I've read a bunch of other threads with 1603 errors but none of them have been my issue, as far as I can tell.

Any ideas as to what the deal is?

Re: Updating Windows UF to 9.2.0.1 via SCCM - 1603 errors

goelshruti119 — Wed, 21 Aug 2024 18:38:30 GMT

Were you able to get a solution for this as we are also facing the same issue with multiple builds.

Re: Updating Windows UF to 9.2.0.1 via SCCM - 1603 errors

nmohammed — Wed, 21 Aug 2024 19:29:12 GMT

What does you msiexec command look like that you're using to install the Splunk UF ?

Re: Updating Windows UF to 9.2.0.1 via SCCM - 1603 errors

jho-splunk — Thu, 29 Aug 2024 23:29:01 GMT

Hi @nmohammed and @goelshruti119 ,

Please see the following reply for instructions on how to troubleshoot: https://community.splunk.com/t5/Installation/Install-issue-on-Server-2016/m-p/540173/highlight/true#...

Cheers,

- Jo.