Upgrading agents fails on multiple Windows endpoints

[Tristan]

Hello Wazuh team,

I'm currently upgrading multiple Wazuh agents from 4.14.4 to 4.14.6, mainly on Windows endpoints. I started the upgrade from the dashboard, selected multiple agents and launched "upgrade agents".

It worked for about 2/3 of them. However, the last ones are not upgrading from the GUI, whether I try selecting them one by one or doing a batch upgrade as I did originally. The error on the dashboard is "Send upgrade command error". I can see that the file needed for the upgrade was received in "C:\Program Files (x86)\ossec-agent\incoming", with the name "wazuh_agent_v4.14.6_windows.wpk".

I then tried to download the MSI manually on the remote endpoints and start it to perform an upgrade using the wizard installer, but it fails with the message "Wazuh Agent Setup Wizard ended prematurely because of an error. Your system has not been modified". I tried to stop the service and uninstall the agent completely using the classic Windows Program manager, but it won't even uninstall.

Failed agents tend to share the same OS Windows versions : 

• Microsoft Windows Server 2019 Standard/Datacenter 10.0.17763.8755
• Microsoft Windows Server 2022 Standard/Datacenter 10.0.20348.5139

I looked for clues in the ossec.log file and the "C:\Program Files (x86)\ossec-agent\upgrade" but didn't find anything.

Any help would be greatly appreciated :)

[Stuti Gupta]

Hi 

The "Send upgrade command error" indicates that the remote upgrade could not be completed. Since the WPK file is already present in the incoming directory, the package transfer appears to have succeeded, so we need to know why the agent could not complete the upgrade.

C:\Program Files (x86)\ossec-agent\logs\2026\Jul

Also, you mentioned that the MSI installation fails and that the agent cannot be uninstalled from Windows Programs and Features. Could you please share the exact error message or a screenshot of the uninstall failure? This will help us understand whether the issue is related to the existing agent installation or the Windows Installer.

For more information about upgrading Wazuh agents, you can refer to:
https://documentation.wazuh.com/current/upgrade-guide/wazuh-agent/index.html
https://documentation.wazuh.com/current/user-manual/agents/remote-upgrading/upgrading-agent.html

[Tristan]

Hi Stuti,

Thank you for your feedback.

You will find the logs from yesterday in the ossec-21.log attached file. I did not try any upgrade before this date that so I don't think you need previous log files.

I tried a new upgrade today from the dashboard but the issue persists, and I don't see any logs in the current ossec.log file related to the operation. The agent is connected to the manager and I receive the alerts, so I don't think it would be a network related problem.

Regarding the uninstall, I don't have any error message, the uninstaller opens and closes immediately, without any message or anything. Here is the menu from where I tried to uninstall ( Windows Programs and Features)  : 

===========================================================================

===========================================================================

Also, here is the error message when I try to start the wazuh-agent-4.14.6-1.msi manually to trigger the upgrade :

===========================================================================

===========================================================================

I already restarted the agent service in Windows multiple times, and it did not change anything.

I used the docs you provided and tried both from Powershell on the remote endpoint and through the CLI on the manager, it still did not work. Here are the results :

===========================================================================

===========================================================================

Thank you for your help

[Stuti Gupta]

Hi Tristan,

From everything you have shared, this is what I understand so far:
You first tried to upgrade the affected agents from the Wazuh Dashboard. Some agents upgraded successfully, but the remaining ones failed with "Send upgrade command error".
The upgrade package (.wpk) was successfully downloaded to the incoming directory, so the package reached the endpoint.
You then tried to upgrade the same agents manually by running the 4.14.6 MSI on the Windows endpoint, but the installer ended with "Wazuh Agent Setup Wizard ended prematurely because of an error."
After that, you tried to uninstall the existing Wazuh agent from Windows Programs and Features, but the uninstaller opens and closes immediately without showing any error.

At this point, the common point is that every operation that changes the agent on these Windows endpoints is failing. This does not appear to be a package download or manager communication issue. The problem seems to be on the affected Windows endpoints, but we still need more information to find the exact cause.

Could you please help us with the following?

Run the installer again and generate a Windows Installer log:
msiexec /i wazuh-agent-4.14.6-1.msi /L*v C:\Temp\wazuh-agent-install.log

Then share the wazuh-agent-install.log file.
Open Event Viewer > Windows Logs > Application and check if there are any MsiInstaller events at the time the install or uninstall failed. If there are, please share them.
When you click Uninstall from Windows Programs and Features, does the uninstall window appear for a moment and then close, or does nothing happen at all?

[Tristan]

Hi Stuti,

I tried what you provided. I ran a Powershell as administrator and executed your MSI command. The GUI installer for the agent opened, I was prompted to accept the User License Agreement, which I did, and then the install failed :

The logs from the .log file are in the attached file "msi_log.txt". Regarding the event viewer, here are the events which were produced : 

• Event ID 1033 (MSI started)

• Event ID 1033 (MSI ended)

• Event ID 1040

• Event ID 1042 (Windows Installer says the product was installed with result code 1603)

I searched online what could be the meaning of error code 1603, but it seems to be a generic error code for MSI.

Regarding this question "When you click Uninstall from Windows Programs and Features, does the uninstall window appear for a moment and then close, or does nothing happen at all" :

Yes, the uninstaller opens but closes immediately, giving me no time to act on it. I can't provide any screenshot, as I don't even have the time to make one when it happens.

[Stuti Gupta]

Hi Tristan,

From the information you've provided, I can confirm that the upgrade package is successfully reaching the endpoint, but every operation that modifies the existing Wazuh Agent installation is failing. This includes the remote upgrade, the manual MSI upgrade, and the uninstall process, all of which end with Windows Installer error 1603.

As a next step, could you please restart the affected endpoint and then follow the Windows agent upgrade steps from the documentation below?
Using CMD:
NET STOP WazuhSvc

Using PowerShell:
Stop-Service wazuhsvc

https://documentation.wazuh.com/current/upgrade-guide/wazuh-agent/windows.html

After completing the upgrade steps, please make sure the Wazuh Agent service is running. If it is already running, stop it first and then start it again.

Using CMD:
NET START WazuhSvc

Using PowerShell:
Start-Service wazuhsvc

Please let us know if the upgrade completes successfully after the restart. If the issue persists, share any new error messages or logs that are generated after following these steps. We may need to escalate the issue.