topic Re: CORTEX XDR Installation Error 1067 in Cortex XDR Discussions

CORTEX XDR Installation Error 1067

FabioGarcia — Thu, 09 Apr 2020 13:29:00 GMT

I am not able to install COrtex XDR in a WIN10 computer;

When we try to start the service below we received error message 1067

Re: CORTEX XDR Installation Error 1067

Retired Member — Thu, 09 Apr 2020 19:00:00 GMT

Hi Fabio,

Could you run again the installation following the https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xdr/7-0/cortex-xdr-agent-admin/cortex-xdr-agent-admin.pdf page 9 to get installation logs?

msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn

Please post the logs so we can have more context and help you out.

Thanks,

Re: CORTEX XDR Installation Error 1067

Retired Member — Tue, 14 Apr 2020 13:20:10 GMT

Make sure you have the two certificates installed on the machine then try to re-start the installation.

Re: CORTEX XDR Installation Error 1067

dfalcon — Thu, 16 Apr 2020 15:43:25 GMT

Hi @FabioGarcia-

Were you able to run the installers with verbose logging? If so, and you are still having the issue, can you please post the log snippet with the error description?

Re: CORTEX XDR Installation Error 1067

FabioGarcia — Thu, 16 Apr 2020 20:59:26 GMT

Hello thanks for the feedback!

I am attaching some log files

Re: CORTEX XDR Installation Error 1067

dfalcon — Mon, 20 Apr 2020 17:57:11 GMT

Hi there. Out of curiosity, have you tried to launch a command prompt as an administrator and kick off the MSI from there? The 1603 error in the logs makes me lean this direction. Also, TAC should be able to resolve this one quickly. Have you tried reaching out to Support?

Re: CORTEX XDR Installation Error 1067

Muhammad-Rusli — Mon, 22 Nov 2021 11:41:31 GMT

Sorry Expert, I have same issue.

The Cortex XDR agents appears pop up same like above, but after I tried to uninstall XDR agent, the process is stuck.

I tried to generate logs for TAC support, but cytray/icon XDR console is not showing.

Please help me how to Can I generate support log XDR if the cytray not appears.

Re: CORTEX XDR Installation Error 1067

P.Jacob — Mon, 22 Nov 2021 15:11:22 GMT

sounds like you need to run the agent cleaner on the asset first, then reboot and you should be good to go.

Re: CORTEX XDR Installation Error 1067

Muhammad-Rusli — Tue, 23 Nov 2021 02:37:21 GMT

How can do that? do u have tutorial for that?

Re: CORTEX XDR Installation Error 1067

bbarmanroy — Tue, 23 Nov 2021 04:06:44 GMT

Hi @Muhammad-Rusli Looks like there are two parts to your problem:

Generating a support file
Uninstalling an agent

Generating a Support File

You can generate support file from the XDR console . You can do it from the Endpoint Administration page or from Action Center.

1. Navigate to Endpoints -> Endpoint Management -> Endpoint Administration.

2. Right-click on the affected endpoint, navigate to Endpoint -> Endpoint Control -> Retrieve Support File

The process to retrieve a support file from the Action Center is described here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

Uninstalling an agent

Please create a Support ticket at the Customer Support Portal (link), with the Support File. The TAC Engineer will advise you accordingly on the uninstallation process.

Hope this helps!

Re: CORTEX XDR Installation Error 1067

Muhammad-Rusli — Tue, 23 Nov 2021 04:59:45 GMT

Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.

Do u have any other way for getting generate logs?

Re: CORTEX XDR Installation Error 1067

bbarmanroy — Tue, 23 Nov 2021 08:10:31 GMT

Hi @FabioGarcia Can you try using a supported version of the agent (v>7.1)? Is this happening on 1 host or on multiple hosts? If the installation fails on the supported versions, please generate the support files for a subset of affected hosts and create a support ticket for a prompt triage and resolution.

Re: CORTEX XDR Installation Error 1067

bbarmanroy — Tue, 23 Nov 2021 09:17:46 GMT

That is an interesting edge case. Is the agent still installed on the endpoint?

You can try executing and see if this works: cytool log collect

Link: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/troubleshoot-cortex-xdr-for-windows/cytool.html

@Muhammad-Rusli wrote:
Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.
Do u have any other way for getting generate logs?

Re: CORTEX XDR Installation Error 1067

bbarmanroy — Tue, 23 Nov 2021 10:06:50 GMT

@Muhammad-Rusli wrote:
Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.
Do u have any other way for getting generate logs?

@Muhammad-Rusli If you're looking to uninstall the agent manually, you can raise a support ticket in any case. They should be able to provide you with a cleaner tool to ensure a successful removal.