Troubleshooting Azure Code Signing

[clairehar557ris]

Hello,

With recent Cortex XDR updates, Microsoft KB5022661 is now a prerequisite for many legacy Windows systems. If your endpoints are missing this, upgrades will fail.

[susekar]

Hello @clairehar557ris ,

Thank you for the response.

Since March 2023, Microsoft has required security vendors to sign binaries using Microsoft Trusted Signing (formerly known as Azure Code Signing or ACS). Consequently, all Cortex XDR agent versions released after this date require endpoints to have specific Microsoft Windows patches to validate these signatures.

Prerequisite Details

Required Patch:
Microsoft KB5022661 or any newer cumulative update that includes its contents.

Affected Systems:
This primarily impacts legacy systems including:

• Windows 10 (older versions)

• Windows 7 SP1 (requires an extended support license to install the patch)

• Windows Server 2008 R2 SP1, 2012, 2012 R2, 2016, and 2019

Note:
Windows 11 machines have this support pre-installed and are generally unaffected.

Symptoms of Missing Prerequisite

If the required patch or cumulative update is missing, Cortex XDR agent installations or upgrades will fail with the following indicators:

• Error Message:
  “Cortex XDR requires Azure Code Signing support. See Microsoft KB5022661 for details”

• Console Error:
  The upgrade status may show as Failed with an Installer timed out error

• MSI Error:
  Log files typically record MSI error code 1603

Resolution and Workarounds:

Apply Cumulative Updates:
Ensure the endpoint is updated with the latest Microsoft security quality updates. If KB5022661 is not found individually in the Microsoft Update Catalog, it has been superseded by more recent cumulative updates.

Verify Installation:
You can verify whether the patch is present by running the following command in an elevated command prompt:

wmic qfe get hotfixid | find "KB5022661"

Bypass Flag (Critical Environment Agents Only):
For environments where patching is not possible, Critical Environment (CE) agent versions (specifically 7.9.103-CE and 8.3-CE) allow a bypass.

Perform a fresh installation using the following MSI flag:

msiexec /i <installer.msi> NO_ACS_SUPPORT=1

Limitation:
This flag cannot be used for upgrades; a clean reinstallation is required. Standard agent versions (for example, version 8.7) ignore this flag and will still fail if the required patch is missing.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar