CORTEX XDR Installation Error 1067

[FabioGarcia]

I am not able to install COrtex XDR in a WIN10 computer;

When we try to start the service below we received error message 1067

[dmichelucc]

Hi Fabio,

Could you run again the installation following the https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cortex/cortex-xdr/7-0/cortex-xdr-ag... page 9 to get installation logs?

msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn 

Please post the logs so we can have more context and help you out.

Thanks,

[hhiggins]

Make sure you have the two certificates installed on the machine then try to re-start the installation.

[dfalcon]

Hi @FabioGarcia-

Were you able to run the installers with verbose logging?  If so, and you are still having the issue, can you please post the log snippet with the error description?

[FabioGarcia]

Hello thanks for the feedback!

I am attaching some log files

[dfalcon]

Hi there.  Out of curiosity, have you tried to launch a command prompt as an administrator and kick off the MSI from there?  The 1603 error in the logs makes me lean this direction.  Also, TAC should be able to resolve this one quickly.  Have you tried reaching out to Support?

[Muhammad-Rusli]

Sorry Expert, I have same issue.

The Cortex XDR agents appears pop up same like above, but after I tried to uninstall XDR agent, the process is stuck.

I tried to generate logs for TAC support, but cytray/icon XDR console is not showing.

Please help me how to Can I generate support log XDR if the cytray not appears.

[PeteJacobCF]

sounds like you need to run the agent cleaner on the asset first, then reboot and you should be good to go. 

[Muhammad-Rusli]

How can do that? do u have tutorial for that?

[bbarmanroy]

Hi @Muhammad-Rusli Looks like there are two parts to your problem:

1. Generating a support file
2. Uninstalling an agent

Generating a Support File

You can generate support file from the XDR console . You can do it from the Endpoint Administration page or from Action Center.

1. Navigate to Endpoints -> Endpoint Management -> Endpoint Administration.

2. Right-click on the affected endpoint, navigate to Endpoint -> Endpoint Control -> Retrieve Support File

The process to retrieve a support file from the Action Center is described here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

Uninstalling an agent

Please create a Support ticket at the Customer Support Portal (link), with the Support File. The TAC Engineer will advise you accordingly on the uninstallation process.

Hope this helps!

[Muhammad-Rusli]

Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.

Do u have any other way for getting generate logs?

[bbarmanroy]

Hi @FabioGarcia Can you try using a supported version of the agent (v>7.1)? Is this happening on 1 host or on multiple hosts? If the installation fails on the supported versions, please generate the support files for a subset of affected hosts and create a support ticket for a prompt triage and resolution.

[bbarmanroy]

That is an interesting edge case. Is the agent still installed on the endpoint?

You can try executing and see if this works: cytool log collect 

Link: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-5/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

---

@Muhammad-Rusli wrote:

Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.

Do u have any other way for getting generate logs?

---

[bbarmanroy]

---

@Muhammad-Rusli wrote:

Hi Bbarmanroy,

Thanks for your advice, If the hostname device already deleted from XDR management and xtray/icon cannot appears in the device.

Do u have any other way for getting generate logs?

---

@Muhammad-Rusli If you're looking to uninstall the agent manually, you can raise a support ticket in any case. They should be able to provide you with a cleaner tool to ensure a successful removal.