@arju can you please uninstall any AV thats installed and retry the pulse client installation?
You would need to collect the MSI logs and look for return value 3 - fatal error"
:::MSI installation logs:::
Create a log:
The most used logging command is /L*VX. This command will create a verbose + extra debug log which offers a lot of information about the installation. Here are the steps for creating a log:
>> Find out the path of the MSI file, for example C:\MyPackage\PulseSecure.msi
>> Decide the path of the log, for example C:\log\MSI-install.log
>> Open cmd.exe (you can use any command shell)
>> Use the msiexec command line to launch the MSI with logging parameters.
Install Log:
For creating an installation log, you can use a command line which looks like this:
msiexec /i "C:\MyPackage\PulseSecure.msi" /L*V "C:\log\MSI-install.log"
The /i parameter will launch the MSI package. After the installation is finished, the log will be complete.
@arju Thank you for sharing the logs, it seems that the WFP driver installation is failing which causes the installation to rollback.
MSI (s) (A0:58) [20:56:56:858]: Executing op: ActionStart(Name=WFPDriverInstall.09558737_3E21_4C64_894B_5F67729A7ED0,,) Action 20:56:56: WFPDriverInstall.09558737_3E21_4C64_894B_5F67729A7ED0. MSI (s) (A0:58) [20:56:56:859]: Executing op: CustomActionSchedule(Action=WFPDriverInstall.09558737_3E21_4C64_894B_5F67729A7ED0,ActionType=3073,Source=BinaryData,Target=driver_install,CustomActionData=PulseSAM.sys) MSI (s) (A0:2C) [20:56:57:193]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSIF3EF.tmp, Entrypoint: driver_install pulseWFPInstDLL 20:56:57 : pulseWFP: driver_install entry CustomAction WFPDriverInstall.09558737_3E21_4C64_894B_5F67729A7ED0 returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) Action ended 20:56:57: InstallExecute. Return value 3. Action 20:56:57: Rollback. Rolling back action:
# Execute the following commands (bold) in cmd and proceed to delete the driver files manually:
>> driverquery /FO LIST | findstr "Pulse"
above command would return something like below:
Display Name: Pulse Secure TDI Filter Driver (jnprTdi_XXX_XXXX) ----> (X would be some version no.)
Module Name: PulseSAM
Display Name: Pulse Secure WFP Driver (PulseSAM)
>> sc delete PulseSAM
>> sc delete jnprTdi_XXX_XXXX
(sc delete would return successfully deleted message or doesn't exist)
>> Navigate to C:\Windows\System32\drivers and search for jnprTdi_XXX_XXXX.sys and PulseSAM.sys file and delete both of them.
>> Reboot the machine and retry the installation.
If the installation fails again, please provide the following logs along with the MSI debuglog:
"C:\Windows\INF\setupapi.setup.log"
"C:\Windows\INF\setupapi.dev.log"
@arju Can you please try creating a file named setupapi.setup.log under %SystemRoot%\Inf directory, change the log level to 0x00007070 (Very-verbose level) and then replicate the issue. Please confirm if events are being updated in the setupapi logs.
To set the event level for the SetupAPI text logs, create (or modify) the following REG_DWORD registry value:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\LogLevel.
Reference - https://docs.microsoft.com/en-us/windows-hardware/drivers/install/setting-the-event-level-for-a-text...
Please change the LogLevel key value to 0x00000000 (default log level) after replicating the issue.
