PENDING SCCM Application Deployment Issues

[vprollc]

Hello everyone,

I am having some issues with SCCM and package/application deployment. I can create the application fine in SCCM and confirmed it is deployed properly to the distribution point from the place where the content is stored. When creating the deployment, the files make it to my test machine in the C:\Windows\CCMCache\# directory without issue; however, when I look at event viewer and the SCCM logs, the application never installed. In event viewer, I see:

Beginning a Windows Installer transaction: C:\Windows\ccmcache\8\AcroRead.msi. Client Process Id: 12800.

Then a second or so later it is followed with:

Ending a Windows Installer transaction: C:\Windows\ccmcache\8\AcroRead.msi. Client Process Id: 12800.

If I manually run the command line for the installer that is in the deployment type config, everything installs properly from C:\windows\ccmcache\8. I even added msiexec logging so I'd know if the command is executed properly. The log file does show up when I run it manually from that directory; however, if I just deploy the package/application to my test machine, I never see the log file get created, only the quick two events in the event log referenced above.

In the AppEnforce log on the client, I get the following:
+++ Starting Install enforcement for App DT "Adobe Acrobat Reader DC - Windows Installer (*.msi file)" ApplicationDeliveryType - ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506, Revision - 3, ContentPath - C:\Windows\ccmcache\8, Execution Context - System AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
Performing detection of app deployment type Adobe Acrobat Reader DC - Windows Installer (*.msi file)(ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506, revision 3) for system. AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
+++ MSI application not discovered [MSI Product Code: {AC76BA86-7AD7-1033-7B44-AC0F074E4100}, MSI Product version: ] AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
App enforcement environment:
Context: Machine
Command line: msiexec /i "AcroRead.msi" /L*V "C:\log\example.log" /q TRANSFORMS=AcroRead.mst
Allow user interaction: No
UI mode: 0
User token: null
Session Id: 4294967295
Content path: C:\Windows\ccmcache\8
Working directory: AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
Prepared working directory: C:\Windows\ccmcache\8 AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
Found executable file msiexec with complete path C:\Windows\system32\msiexec.exe AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
Prepared command line: "C:\Windows\system32\msiexec.exe" /i "AcroRead.msi" /L*V "C:\log\example.log" /q TRANSFORMS=AcroRead.mst /qn AppEnforce 11/5/2021 2:20:36 PM 1796 (0x0704)
Valid MSI Package path = C:\Windows\ccmcache\8\AcroRead.msi AppEnforce 11/5/2021 2:20:37 PM 1796 (0x0704)
Advertising MSI package [C:\Windows\ccmcache\8\AcroRead.msi] to the system. AppEnforce 11/5/2021 2:20:37 PM 1796 (0x0704)
Executing Command line: "C:\Windows\system32\msiexec.exe" /i "AcroRead.msi" /L*V "C:\log\example.log" /q TRANSFORMS=AcroRead.mst /qn with system context AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
Working directory C:\Windows\ccmcache\8 AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
CMsiHandler::EnforceApp failed (0x80070005). AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
AppProvider::EnforceApp - Failed to invoke EnforceApp on Application handler(0x80070005). AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
CommenceEnforcement failed with error 0x80070005. AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
Method CommenceEnforcement failed with error code 80070005 AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)
++++++ Failed to enforce app. Error 0x80070005. ++++++ AppEnforce 11/5/2021 2:20:38 PM 1796 (0x0704)

The AppDiscovery log also shows the following:
Entering ExecQueryAsync for query "select * from CCM_AppDeliveryType where (AppDeliveryTypeId = "ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506" AND Revision = 3)" AppDiscovery 11/5/2021 2:19:22 PM 1796 (0x0704)
Performing detection of app deployment type Adobe Acrobat Reader DC - Windows Installer (*.msi file)(ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506, revision 3) for system. AppDiscovery 11/5/2021 2:19:22 PM 1796 (0x0704)
+++ MSI application not discovered [MSI Product Code: {AC76BA86-7AD7-1033-7B44-AC0F074E4100}, MSI Product version: ] AppDiscovery 11/5/2021 2:19:22 PM 1796 (0x0704)
+++ Did not detect app deployment type Adobe Acrobat Reader DC - Windows Installer (*.msi file)(ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506, revision 3) for system. AppDiscovery 11/5/2021 2:19:22 PM 1796 (0x0704)
ActionType - Install will use Content Id: Content_aa5724e9-c801-4967-a8ce-d1272711550d + Content Version: 1 for AppDT "Adobe Acrobat Reader DC - Windows Installer (*.msi file)" [ScopeId_7345BBCF-325B-48AE-B7D4-8A44EB663415/DeploymentType_eeaa6a84-c7c3-4c40-80bb-fd634801d506], Revision - 3 AppDiscovery 11/5/2021 2:19:23 PM 1796 (0x0704)
Method EnforceApp failed with error 80070005 AppDiscovery 11/5/2021 2:20:38 PM 1796 (0x0704)
CAppProvider::ExecMethodAsync failed. Error 80070005 AppDiscovery 11/5/2021 2:20:38 PM 1796 (0x0704)

As I mentioned, the files do show up on my test machine, and the command line does appear to be correct; however, it doesn't seem to execute properly with the system account or doesn't seem to really execute properly as it is generating the msiexec events in the event viewer, but they seem to fail almost immediately.

If anyone has any ideas as to why this is occurring I would appreciate any advice.

 

[Garth]

Did you test your deployment using the local system account? Did you create a MSI log file and review it? https://www.recastsoftware.com/resources/how-to-access-the-local-system-account/

 

[vprollc]

Did you test your deployment using the local system account? Did you create a MSI log file and review it? https://www.recastsoftware.com/resources/how-to-access-the-local-system-account/

Thank you for the suggestion...We currently have Attack Surface Reduction rules in place to prevent PSExec from running on our clients which is preventing me from trying to test as System on my machine. I'll see if I can find another way around that and let you know if the install works as expected. When I run the commands from an elevated command prompt with my local admin credentials, the installer works fine and generates the install log output.

Will try and figure out another way to run as System and provide an update.

 

[vprollc]

After finally finding a way to get to System without PSExec, I was able to run the command line msiexec /i "AcroRead.msi" /L*V "C:\log\example.log" /q TRANSFORMS=AcroRead.mst which did install from the c:\windows\ccmcache\8 location where the package downloaded to my test machine.

It installed successfully and did create the install log file in the c:\logs folder per the command line request.

I am still not certain why this is not running properly within SCCM's deployment as the command line is good and can be ran under the System account with no issues.

The only other thing I can provide outside of the log errors in the original post is that if I attempt to install the software via Software Center, it starts the process and fails and states the Package is Expired and will be retired. I am not sure why it things this is the case as there is no expiration date set for the package in the deployment.

Any further advice or suggestions are appreciated as I am at a loss as to why the deployment is not running the command line properly on the local machine.

 

[Garth]

Did you run the setup as x86 or x64 install? How did you run a local system if you didn't use psexec?

 

[vprollc]

Hi Garth...I'm not certain what you are asking about x86 or x64...I took the default options when building the package in SCCM, and when I ran from the command line, I just used the msiexec command line from above. I don't think I told it to run x64 packages as x86 or anything when building things out in SCCM.

To get System access without PSExec, I found a tool called Advanced Run which allowed me to run cmd.exe as System. I did confirm I was system using the whoami command.

In further testing this, it appears the application does successfully install on a test machine, but if removed from the machine and re-deployed with a new deployment in SCCM, it will push the binaries but fail on the installation. It may just be Adobe not fully cleaning itself up and causing issues with the deployment in SCCM's eyes. I'm not really certain what the errors in the logs from my first post are actually stating and it doesn't seem to affect many people on various forums.

 

[Garth]

CM in many cases will run installs in x86 mode, therefore if you manually tested the install you would likely have tested it as x64. Therefore if you read the blog post that posted it will talk about the x86 vs x64 testing.

If it works on a clean machine and not on a "dirty" computer the problem is the computer not the deployment. You will need to review the MSI logs that you create to see what the problem is.

 

[vprollc]

Thank you for the information on the x86/x64 install. I ran the command line to generate the MSI log based on the original command line detailed in the Appxxxx log output from the first post under an x86 command prompt.

The log file generated as it was instructed to and the install succeeded when ran manually on the machine. I am still not quite sure why SCCM is unable to do the same. Also when I go into Software Center and try and install the package from there, it comes back as Status: Past Due - Will Be Retired.

It is strange that sometimes SCCM can install the package once, and other times on completely different machines it just fails with the same errors from the first post and that Software Center states the same message of Past Due - Will Be Retired. I tested that on a newly built and patched Windows 10 machine yesterday.

I'm starting to wonder if our Attack Surface Reduction rules are interfering with SCCM in some way as I did notice a Defender AV warning when I tried to run the install on the fresh Windows 10 machine via Software Center before it failed.

 

[Garth]

I would not be surprise that attach surface is causing a problem.