PulseSecure Won't Install - Windows for ARM / Snapdragon

[PaulieP]

I've tried to get different Pulse Secure versions, legacy and current, both 32 and 64 bit , to install on two different models of Windows 10 devices running on Snapdragon/ARM. One is the HP Envy X2 LTE 12".

is every instance the error is the same, the installer seems to go all the way through with file copy and then quits saying installation has ended prematurely due to an error.

A not uncommon issue, usually blamed on driver/pnputil or Kapersky. Just to save time - There is no Kapersky present, there are no Pulse or juniper entries showing in the pnputil.txt file, error is consistent even with all antivirus and firewalls disabled. The win10 universal app is a no go as it does not support all the features needed for our corporate VPN.

I have not had problems installing pulse on any other windows 10 clients, just these ARM based ones.

Has anyone done this or have any suggestions? Probably related to driver/adapter install. Thanks

Paul

[[email protected]]

Hi Paul,

What do you see in the MSI install logs?

Check for return value 3 (fatal error) and backtrace to the cause.

[PaulieP]

Hi, where would the logs be located? Do I need to enable logging, or are the logs saved even after the temporary install directory is deleted at install failure?

[[email protected]]

Hi @PaulieP,

Yes, you have enable logging using msiexec switch commands.

Use this syntax: msiexec /i <msi file path> /l*vx <log file path>   Note: "/l" the keyword here is lowercase L.

For eg: <msi file path> - C:\PulseSecure.msi & <log file path> - C:\msilog.txt.

[PaulieP]

Ok Thanks. Results for failures with 32-bit and 64-bit Pulse Secure installers.. see below.

have a look and let me know what you think... Thanks

(Windows 10 on ARM64 / Snapdragon 8XX)

32-bit installer: 

MSI (s) (E4:70) [21:56:35:800]: Doing action: MsiProcessDrivers
MSI (s) (E4:70) [21:56:35:800]: Note: 1: 2205 2:  3: ActionText
Action 21:56:35: MsiProcessDrivers.
Action start 21:56:35: MsiProcessDrivers.
MSI (s) (E4:70) [21:56:35:804]: Creating MSIHANDLE (450) of type 790542 for thread 3952
MSI (s) (E4:38) [21:56:35:805]: Invoking remote custom action. DLL: C:\WINDOWS\Installer\MSI9D7F.tmp, Entrypoint: ProcessDriverPackages
MSI (s) (E4!54) [21:56:35:837]: Creating MSIHANDLE (451) of type 790531 for thread 11860
DIFXAPP: ENTER: ProcessDriverPackages()
MSI (s) (E4!54) [21:56:35:838]: Closing MSIHANDLE (451) of type 790531 for thread 11860
MSI (s) (E4!54) [21:56:35:839]: Creating MSIHANDLE (452) of type 790531 for thread 11860
DIFXAPP: ERROR - You need to use the 64-bit version of DIFXAPP.DLL to install drivers on this machine.
MSI (s) (E4!54) [21:56:35:839]: Closing MSIHANDLE (452) of type 790531 for thread 11860
CustomAction MsiProcessDrivers returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (E4:38) [21:56:35:842]: Closing MSIHANDLE (450) of type 790542 for thread 3952
Action ended 21:56:35: MsiProcessDrivers. Return value 3.
MSI (s) (E4:70) [21:56:35:955]: Note: 1: 2265 2:  3: -2147287035

64-bit Installer: 

This installation package is not supported by this processor type. Contact your product vendor.
C:\Users\erick\Downloads\pulsesecure64.msi
MSI (c) (E4:64) [22:02:53:949]: Note: 1: 1708
MSI (c) (E4:64) [22:02:53:949]: Product: Pulse Secure -- Installation failed.

[PaulieP]

So essentially if I'm reading this right these are the issues:

1. Windows on ARM is a 64-bit OS

2. Most third party apps have not been compiled for ARM64

3. ....and therefore the 32bit versions have to be used as Win on ARM uses a 32-bit emulation for regular windows apps

4. The Pulse installer for 32bit sees a 64bit OS and wants to use a 64bit DIFXAPP.DLL for driver install

5. Pulse installer for 64bit, not compiled for ARM64, fails as it detects the 32bit emulation environment.

Therefore, is there a way for me using freeware or commercial tools, to create a mixed mode MSI? I need to install the 32-bit drivers and files, but using the requisite files that will get past the OS being 64-bit. Or at least replacing DIFXAPP.DLL with the 64-bit version and rebuilding the MSI..

Any ideas anyone?

Though to be honest - the Pulse Secure client team should have already done this ...to make a version that works on the new generation of always connected Win10 devices on ARM..

[zanyterp]

That sounds like something that could be beneficial for multiple users. I would recommend reaching out to your account team to let them know that this is a feature that would benefit you so they can let the product management team be aware of the need

[PaulieP]

I don't have any sway with the account manager.

But this should be of interest to Pulse Secure to make it happen regardless.

Microsoft is pushing ahead with Windows on ARM and working with Qualcomm to make sure their next gen of compute-specific SoCs for always-on Windows laptops work well.

Tom's Guide: Get Ready for a Surface Pro 7 with ARM and Surface Laptop 3 with AMD.
https://www.tomsguide.com/us/microsoft-surface-pro-7-arm-amd,news-30453.html

Meaning we could have a Surface Pro 7 on ARM launch happen end of this year or early next, with no standalone Pulse Secure client able to be installed.

The "app" available via UWP download from the Windows Store that simply leverages Windows 10's built-in VPN is barebones and insufficient for many. It's also rejected by my IT dept. On my Intel machines only the standalone Pulse client is allowed/pushed/maintained by enterprise admins.

Therefore Pulse Secure needs to fix its standalone installer to work with Windows on ARM machines. Right now it fails to install because it is unable to deal with the mixed -mode environment used by Windows on ARM machines to emulate 32-bit.

Or, putting an actual full-blown UWP-compliant version Pulse Secure client in Windows Store would fix everything. And even run on Windows on ARM machines locked down into Windows 10 S Mode.

[jordanl17]

So it's confirmed there will be a Surface 7 ARM version announced tomorrow.  I WANT IT. and so will lots of other professionals that use Pulse vpn.  

Paul, did you solve the inability for Pulse Secure to install on ARM devices?

Pulse Secure, don't wait until enough people are pissed off to do this.  ARM is clearly happening.  just fix the 32bit installer OR create Microsoft Store app (a real one). 

[CBW]

I recently purchased a Surface Pro X at work and same issue for me. I cannot get the x86 Pulse client to install which is required by my IT department for the NAC features. I will take it to my account team because for us, the ARM Surface models are not an option without a VPN client.