After Internet Explorer retirement, PSAL failed with Detected Internal Error

[tnguyendoit]

This is just an FYI for forum users/other admins. We have already opened a case with Support.  It's affecting a bunch of new users.

-----------------------------------

This is affecting users of ALL of our virtual appliances, both those appliances running the latest PCS 9.1R15 and those running previous PCS 9.1R12

After Microsoft Internet Explorer has been retired, an issue starts occurring to new user who connects over the web to use Terminal Services (using any browser e.g. Chrome, Edge, Firefox). PSAL would always throw "Detect Internal Error".

Those users have never had any Pulse helper component installed on their system. When they connect, they're prompted to download PSAL. After they downloaded and installed PSAL, it prompted them to install (requires admin privileges) the ActiveX components OCX and OCX64 of Pulse Secure Setup Client. After that PSAL was supposed to invoke the Pulse Setup Client to download and install Host Checker, etc but throw "Detect Internal Error"

This is happening when connecting to appliances running either PCS 9.1R12 or 9.1R15.

This is happening regardless whether the endpoint is running Windows 10 20H2 or 21H2.

This is happening even on fresh clean plain-vanilla stock Windows 10.

This is happening even though the users have local admin privileges.

This is happening regardless of the browser the user uses (Google Chrome, Microsoft Edge, Mozilla Firefox)

This is happening EVEN IF all Pulse helper components (PSAL, Pulse Secure Setup Client, Pulse Secure Installer Service, Host Checker) are downloaded and installed MANUALLY (as MSI / EXE)

NOTE: If a user has already had all the Pulse helper components installed PRIOR to Internet Explorer retirement, those already-installed existing components appear to continue working without issue. This issue is only occurring to users who have never had Pulse helper components installed and attempt to do so AFTER Internet Explorer retirement date.

NOTE: Ivanti/Pulse Secure Support personnel and development/engineering should be able to reproduce this in their lab. Just set up a realm mapped to a role with TS enabled, and a HC policy set to Evaluate for that realm then connect from a fresh Windows 10 box which has never ever had any Pulse helper components on it.

[zanyterp]

thank you for the head's up on this unexpected impact of that removal and sharing with the wider community as well as already having a case in place for us to investigate

[tnguyendoit]

False alarm.  The IE retirement date might just be coincidental.

On a test VM, turned out the culprit was a leftover ActiveX control in "C:\Windows\Downloaded Program Files" which might have been damaged somehow.

After I removed that manually after using takeown and icacls, the NEW 9.1R15 Pulse Secure Setup Client downloaded and installed correctly, and PSAL was able to invoke it to download/install Host Checker and Pulse Terminal Services Client.

[zanyterp]

thank you for the update