Installing the forwarder manually works fine, installing it automatically with the same user account fails with a 1603 error. Installer logs snippet:
MSI (s) (B8:FC) [09:22:23:304]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038 MSI (s) (B8:FC) [09:22:23:304]: Note: 1: 2205 2: 3: LaunchCondition MSI (s) (B8:FC) [09:22:23:304]: Note: 1: 2228 2: 3: LaunchCondition 4: SELECT `Condition` FROM `LaunchCondition` MSI (s) (B8:FC) [09:22:23:304]: APPCOMPAT: [DetectVersionLaunchCondition] Failed to initialize pRecErr. MSI (s) (B8:FC) [09:22:23:304]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'. MSI (s) (B8:FC) [09:22:23:304]: Doing action: INSTALL MSI (s) (B8:FC) [09:22:23:304]: Note: 1: 2205 2: 3: ActionText Action start 9:22:23: INSTALL. MSI (s) (B8:FC) [09:22:23:320]: Running ExecuteSequence MSI (s) (B8:FC) [09:22:23:320]: Doing action: SetAllUsers MSI (s) (B8:FC) [09:22:23:320]: Note: 1: 2205 2: 3: ActionText MSI (s) (B8:EC) [09:22:23:320]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI5F93.tmp, Entrypoint: SetAllUsersCA MSI (s) (B8:F8) [09:22:23:320]: Generating random cookie. MSI (s) (B8:F8) [09:22:23:320]: Created Custom Action Server with PID 976 (0x3D0). MSI (s) (B8:3C) [09:22:23:335]: Running as a service. MSI (s) (B8:3C) [09:22:23:335]: Hello, I'm your 64bit Impersonated custom action server. Action start 9:22:23: SetAllUsers. SetAllUsers: Debug: Num of subkeys found: 1. SetAllUsers: Info: Previously installed Splunk product is not found. SetAllUsers: Error: Failed SetAllUsers: 0x2. SetAllUsers: Info: Leave SetAllUsers: 0x80004005. CustomAction SetAllUsers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 9:22:23: SetAllUsers. Return value 3. Action ended 9:22:23: INSTALL. Return value 3.
... View more