Unable to Uninstall or over write with new version of Splunk universal forwe

[AkshayKrishna]

Hi Team,

We are facing an issue with the Splunk Universal Forwarder (UF) on one of our Windows servers.

In Services.msc, the Splunk service is not running, and after disabling it we are no longer able to see “Splunk” in the list of services.

We manually deleted the C:\Program Files\SplunkUniversalForwarder folder, thinking it might help.

Now, when we try to uninstall/reinstall/update UF using msiexec, we receive the error:

> “This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.”

The installer also complains that “policies are stopping the installation or modification,” even though we are running with local Administrator/root privileges.

We also noticed leftover entries in the registry and suspect there may be orphaned MSI references blocking the installation.

Has anyone faced this before?

What’s the best way to fully clean up old Splunk UF services, registry entries, and MSI remnants so that we can do a fresh installation?

Are there recommended steps/tools from Splunk for handling corrupted or partially removed UF installations on Windows?

Any guidance would be appreciated.

[PrewinThomas]

@AkshayKrishna 

You can follow below doc for clean up and try with fresh installation.

#https://splunk.my.site.com/customer/s/article/Troubleshooting-Windows-Installer-MSI

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[AkshayKrishna]

 I cannot install Procmon.exe, not allowed in my org is there any other ways to do it without any addons.

@PrewinThomas

[PrewinThomas]

@AkshayKrishna 

PROCMON is not mandatory, its only to gather more info. Basically with windows admin help, you can perform following to remove any rrphaned MSI references

Delete the splunk windows service (if still present)
Delete residual files & folders (anything related to Splunk)
Manually clean registry entries
Remove installer cache files if any

After removing all these references and reboot should fix orphaned msi reference issues.

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!