Forwarder 9.1.1 update failed on Domain Controller

New Member


The update installation of the forwarder is not running and a roll-back is being performed. During further tests I have activated the verbose logging of the MSI installer. The following error occurs here:

Cannot set GROUPPERFORMANCEMONITORUSERS=1 since the local users/groups are not available on Domain Controller.

He is probably right. But why does the installer try to set this parameter at all during an update installation? Unfortunately, I cannot set any further options here during an update. There is clearly a bug in the installer script.

Any Ideas?


Action 14:44:08: SetAccountTypeData.
Action start 14:44:08: SetAccountTypeData.
MSI (s) (A0:60) [14:44:08:562]: PROPERTY CHANGE: Adding SetAccountType property. Its value is 'UseVirtualAccount=;UseLocalSystem=0;UserName=D3622070\SIEM-EVNT-READER;FailCA='.
Action ended 14:44:08: SetAccountTypeData. Return value 1.
MSI (s) (A0:60) [14:44:08:562]: Doing action: SetAccountType
MSI (s) (A0:60) [14:44:08:562]: Note: 1: 2205 2: 3: ActionText
Action 14:44:08: SetAccountType.
Action start 14:44:08: SetAccountType.
MSI (s) (A0:F0) [14:44:08:562]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIAC9D.tmp, Entrypoint: SetAccountTypeCA
SetAccountType: Error 0x80004005: Cannot set GROUPPERFORMANCEMONITORUSERS=1 since the local users/groups are not available on Domain Controller.
CustomAction SetAccountType returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 14:44:08: SetAccountType. Return value 3.
MSI (s) (A0:60) [14:44:08:594]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (A0:60) [14:44:08:594]: User policy value 'DisableRollback' is 0
MSI (s) (A0:60) [14:44:08:594]: Machine policy value 'DisableRollback' is 0
MSI (s) (A0:60) [14:44:08:594]: Note: 1: 2318 2:
MSI (s) (A0:60) [14:44:08:609]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1467512195,LangId=1033,Platform=589824,ScriptType=2,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
MSI (s) (A0:60) [14:44:08:609]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (A0:60) [14:44:08:609]: Executing op: DialogInfo(Type=1,Argument=UniversalForwarder)
MSI (s) (A0:60) [14:44:08:609]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (A0:60) [14:44:08:609]: Executing op: RegisterBackupFile(File=C:\Config.Msi\b08a3953.rbf)


Labels (3)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...