Update from Traps to Cortex

[PierazzoD]

Hello everyone,

I'm trying to update the Traps agent 5.0.11 to Cortex 7.4.0 on Windows Server 2008/2008R2.

When I'm installing the new version, in the moment to start the services, the installation go in rollback.

I've tried to install directly the new version.

Unistall Traps,  clean with XDR agent cleaner and install the new version, same problem.

I'm able to install only Traps 5.0.11, with protection disabled, but connected to console.

Have you got some suggestions?

[PierazzoD]

I've controlled the permission of the user and seems to me that it has the right privilege.

these are the log i got from event viewer of Windows

log1:

Log Name: System
Source: Service Control Manager
Date: 27.01.2022 12:33:35
Event ID: 7000
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: MyServer.Domain
Description:
The cyvrmtgn service failed to start due to the following error:
Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2022-01-27T11:33:35.055852400Z" />
<EventRecordID>1005547</EventRecordID>
<Correlation />
<Execution ProcessID="1056" ThreadID="3788" />
<Channel>System</Channel>
<Computer>ITSPDB01.intranet.salewa.com</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">cyvrmtgn</Data>
<Data Name="param2">%%577</Data>
</EventData>
</Event>

Log2:

Log Name: Application
Source: MsiInstaller
Date: 27.01.2022 10:11:37
Event ID: 1033
Task Category: None
Level: Information
Keywords: Classic
User: DomainAdmin
Computer: MyServer.Domain
Description:
Windows Installer installed the product. Product Name: Cortex XDR 7.6.0.43778. Product Version: 7.6.0.43778. Product Language: 1033. Manufacturer: Palo Alto Networks, Inc.. Installation success or error status: 1603.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="MsiInstaller" />
<EventID Qualifiers="0">1033</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2022-01-27T09:11:37.000000000Z" />
<EventRecordID>17677055</EventRecordID>
<Channel>Application</Channel>
<Computer>ITSPDB01.intranet.salewa.com</Computer>
<Security UserID="S-1-5-21-861567501-484061587-725345543-500" />
</System>
<EventData>
<Data>Cortex XDR 7.6.0.43778</Data>
<Data>7.6.0.43778</Data>
<Data>1033</Data>
<Data>1603</Data>
<Data>Palo Alto Networks, Inc.</Data>
<Data>(NULL)</Data>
<Data>
</Data>
<Binary>7B46364144333634302D434530432D344539312D413446392D4343313836433530464335337D3030303033656464653732656261356330373032353264656631623930346337623261643030303030393034</Binary>
</EventData>
</Event>

I've tried also with localadmin of server, but i've always the error at the moment to start new services (cyvera).

[etugriceri]

Dear PierazzoD

"Windows cannot verify the digital signature for this file. " log is clear indication of the problem. You can clean XDR with cleaning tool. For the getting this tool, You need to open a ticket via support portal and then you can try again to install. 

Alternative solution, Required certificates are installing to certificate store when you install XDR. so You may try to DDISABLE_INTEGRITY_CHECKS with bcdedit. Try to upgrade and restore to old configs (enable integrity check). Btw, I've never tried this before and thats why I'm gonna recommend open a support request again.