Why this error, Unable to install Universal Forwarder on Windows Server 2022 (error 1603)?

[kyuubyhades]

Hi everybody,

I've been struggling for hours to install splunks universal forwarder on windows server 2022.

Here's the msiexec logs : https://drive.google.com/file/d/1NtNN9mT97-gbwprIc4cCAec5mi7Jhl6H/view?usp=sharing 

Help 😛

[gcusello]

Hi @kyuubyhades,

I suppose that you're trying to install a forwarder with version greater than 8.2.5, that's the first version certified for Windows Server 2022.

It's a strange error because the installation pachege doesn't find some files.

See in $TEMP$\splunk.log and in $SPLUNK_HOME\var\log\splunk\first_install.log if there some additional information

I hint at first to try on another server Windows 2022 to understand if it's alocal issue or general, then anyway to open a case to Splunk Support.

Ciao.

Giuseppe

[kyuubyhades]

Thanks for the tip @gcusello ,

I am indeed installing it with the latest version available.

I finally managed to install it yesterday once i removed all existing files created by the other install attempts.

I still don't understand why i couldn't install it the first x times i tried.

Best regards 🙂

[cbreitenstrom]

Hi,

according to the log, our customer has exactly the same error. Will try to convince them, to uninstall UF completely and install once again.

Their first install ended with:

SetAccountType:  Error 0x80004005: Cannot set USE_ADMIN_USER=1 since the local users/groups are not available on Domain Controllers.

May be this installation trial causes the failure later on...

[PickleRick]

OK. That actually makes sense. I'm no AD expert but indeed as far as I remember you cannot use local accounts on domain controllers - all "local" accounts are indeed domain accounts. If this is not described in the forwarder installation manual, it could be worth posting a feedback (there is a feedback form on the bottom of every doc page).

[gcusello]

Hi @kyuubyhades,

good for you, if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉