wazuh agent not reinstall
305 views
Skip to first unread message
Андрей Игоревич
May 6, 2025, 2:16:28 AM5/6/25
to Wazuh | Mailing List
Good day to all. Sorry for my English.
When installing the agent on Win, the following happens:
The installation is successful, but the arguments WAZUH_MANAGER="10.11.12.13" WAZUH_REGISTRATION_SERVER="10.11.12.13" WAZUH_REGISTRATION_PASSWORD="1234567890" are not accepted. As a result, after installation there is neither a password nor a server address
<client>
<server>
<address>0.0.0.0</address>
<port>1514</port>
<protocol>tcp</protocol>
</server>
<crypto_method>aes</crypto_method>
<notify_time>10</notify_time>
<time-reconnect>60</time-reconnect>
<auto_restart>yes</auto_restart>
</client>
powershell command as administrator msiexec.exe /i C:\wazuh-agent.msi /q WAZUH_MANAGER="10.11.12.13" WAZUH_REGISTRATION_SERVER="10.11.12.13" WAZUH_REGISTRATION_PASSWORD="1234567890"
I didn't encounter such a problem during installation, but I encountered it during reinstallation. Since there are more than 5000 agents, fixes like "rewrite the configuration manually, create a file with a password and write it there" do not work. A solution to the problem is required. I will also note that the encoding used is UTF-8.
When installing the agent on Win, the following happens:
The installation is successful, but the arguments WAZUH_MANAGER="10.11.12.13" WAZUH_REGISTRATION_SERVER="10.11.12.13" WAZUH_REGISTRATION_PASSWORD="1234567890" are not accepted. As a result, after installation there is neither a password nor a server address
<client>
<server>
<address>0.0.0.0</address>
<port>1514</port>
<protocol>tcp</protocol>
</server>
<crypto_method>aes</crypto_method>
<notify_time>10</notify_time>
<time-reconnect>60</time-reconnect>
<auto_restart>yes</auto_restart>
</client>
powershell command as administrator msiexec.exe /i C:\wazuh-agent.msi /q WAZUH_MANAGER="10.11.12.13" WAZUH_REGISTRATION_SERVER="10.11.12.13" WAZUH_REGISTRATION_PASSWORD="1234567890"
I didn't encounter such a problem during installation, but I encountered it during reinstallation. Since there are more than 5000 agents, fixes like "rewrite the configuration manually, create a file with a password and write it there" do not work. A solution to the problem is required. I will also note that the encoding used is UTF-8.
Bony V John
May 6, 2025, 3:16:11 AM5/6/25
to Wazuh | Mailing List
Hi,
Before reinstalling the Wazuh agent, ensure that you have properly uninstalled the existing Wazuh agent from the endpoint.
You can run the following command to completely remove the agent from a Windows endpoint:
msiexec.exe /x wazuh-agent-4.11.2-1.msi /qn
This will completely remove the Wazuh agent from your Windows endpoint.
Refer to the official documentation for more details:
Uninstalling a Windows Wazuh Agent
If it's missing from the list, delete the installation folder manually:
Refer to the official documentation for more details:
Uninstalling a Windows Wazuh Agent
If it's missing from the list, delete the installation folder manually:
Open Powershell as administrator and run this command to remove all files.
Remove-Item -Recurse -Force "C:\Program Files (x86)\ossec-agent"
Then you can reinstall the Wazuh agent by following this document.
https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-windows.html
https://documentation.wazuh.com/current/installation-guide/wazuh-agent/wazuh-agent-package-windows.html
In Step 2, you can include the deployment variables as shown below. Make sure the registration password is correct:
.\wazuh-agent-4.11.2-1.msi /q WAZUH_MANAGER="10.0.0.2" WAZUH_REGISTRATION_SERVER="10.0.0.2" WAZUH_REGISTRATION_PASSWORD="TopSecret"
Replace the variables with your actual Wazuh manager IP address and registration password.
You can refer to the Wazuh Deployment Variables documentation for more details.
Once the installation is complete, start the Wazuh agent service using:
NET START Wazuh
If the issue still persists, please provide the following files for further investigation:
-
Agent log file: C:\Program Files (x86)\ossec-agent\ossec.log
-
Agent configuration file: C:\Program Files (x86)\ossec-agent\ossec.conf
-
Check if the authd.pass file exists in: C:\Program Files\ossec-agent\authd.pass
Also, share the following files from the Wazuh manager:
-
Wazuh manager log file: /var/ossec/logs/ossec.log
-
Wazuh manager configuration file: /var/ossec/etc/ossec.conf
You can refer to the Wazuh Password Authentication documentation for more details on agent registration.
Андрей Игоревич
May 7, 2025, 4:13:41 AM5/7/25
to Wazuh | Mailing List
I did everything according to the specified algorithm.
Unfortunately, the problem remains.
I am sending the configurations and screenshots.
I do not have to send the entire configuration, I ask for understanding.
Thanks in advance!
Unfortunately, the problem remains.
I am sending the configurations and screenshots.
I do not have to send the entire configuration, I ask for understanding.
Thanks in advance!
вторник, 6 мая 2025 г. в 14:16:11 UTC+7, Bony V John:
Андрей Игоревич
May 7, 2025, 4:13:50 AM5/7/25
to Wazuh | Mailing List
I would like to emphasize the importance of finding the source of the problem and fixing it in order to know how to work with 5000 agents during an update (and partially reinstallation)
The method of fixing the agent config manually is not suitable
Thanks in advance!
The method of fixing the agent config manually is not suitable
Thanks in advance!
вторник, 6 мая 2025 г. в 14:16:11 UTC+7, Bony V John:
Hi,
Андрей Игоревич
May 7, 2025, 4:13:57 AM5/7/25
to Wazuh | Mailing List
there is an error on the screenshot (msiexec.exe /x wazuh-agent-4.11.2-1.msi /qn
I fixed it, repeated everything and got the same result
msiexec.exe /x C:\wazuh-agent-4.10.1-1.msi /qn)
I fixed it, repeated everything and got the same result
msiexec.exe /x C:\wazuh-agent-4.10.1-1.msi /qn)
вторник, 6 мая 2025 г. в 14:16:11 UTC+7, Bony V John:
Hi,
Bony V John
May 12, 2025, 11:58:45 PM5/12/25
to Wazuh | Mailing List
Hi,
Apologies for the late response. I understand your requirement. Upon checking the agent configuration, it appears that the Wazuh manager IP address is not being correctly updated in the agent configuration.
You can try running the agent installation command in verbose mode, which will print detailed output during the installation process. This can help identify any issues that might be occurring during installation. Use the following command:
Start-Process msiexec.exe -ArgumentList '/i', 'wazuh-agent-4.12.0-1.msi', '/qn', '/l*v', 'C:\Temp\wazuh-agent-install.log', 'WAZUH_MANAGER=10.0.0.2', 'WAZUH_REGISTRATION_SERVER=10.0.0.2', 'WAZUH_REGISTRATION_PASSWORD=TopSecret', 'WAZUH_AGENT_GROUP=default' -Wait
Get-Content -Path 'C:\Temp\wazuh-agent-install.log' -Wait
Get-Content -Path 'C:\Temp\wazuh-agent-install.log' -Wait
In the command above:
-
I have included the agent group, which is necessary during agent installation.
-
Replace 10.0.0.2 with the actual IP address of your Wazuh manager server.
-
Replace the registration password with the appropriate one from your environment.
After running the command, please share the output and log file for further analysis.
Additionally, please provide the following for further troubleshooting:
-
The full log file of the agent located at:
C:\Program Files (x86)\ossec-agent\ossec.log
-
The full ossec.conf file from your Wazuh manager to review the authentication configuration.
-
The Wazuh manager log located at:
/var/ossec/logs/ossec.log
You can also refer to the Wazuh agent deployment variable documentation for more details.
Additionally, you can consider installing the Wazuh agent using the Windows Group Policy Object (GPO) method, which allows you to deploy the agent remotely to Windows endpoints through group policies. This approach is useful for large-scale or centralized deployments. You can refer to the Wazuh blog for step-by-step guidance on this method.
Ivan Sergeevich
May 14, 2025, 12:27:40 PM5/14/25
to Wazuh | Mailing List
msiexec /i wazuh-agent-4.12.0-1.msi /qn /l*v install.log WAZUH_MANAGER="192.1.1.1"
=== Verbose logging started: 14.05.2025 18:33:50 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\system32\msiexec.exe ===
MSI (c) (08:BC) [18:33:50:582]: Resetting cached policy values
MSI (c) (08:BC) [18:33:50:582]: Machine policy value 'Debug' is 0
MSI (c) (08:BC) [18:33:50:582]: ******* RunEngine:
******* Product: wazuh-agent-4.12.0-1.msi
******* Action:
******* CommandLine: **********
MSI (c) (08:BC) [18:33:50:582]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (08:BC) [18:33:50:582]: Grabbed execution mutex.
MSI (c) (08:BC) [18:33:50:587]: Cloaking enabled.
MSI (c) (08:BC) [18:33:50:587]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (08:BC) [18:33:50:591]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (60:D8) [18:33:50:595]: Running installation inside multi-package transaction c:\wazuh-agent-4.12.0-1.msi
MSI (s) (60:D8) [18:33:50:595]: Grabbed execution mutex.
MSI (s) (60:9C) [18:33:50:596]: Resetting cached policy values
MSI (s) (60:9C) [18:33:50:596]: Machine policy value 'Debug' is 0
MSI (s) (60:9C) [18:33:50:596]: ******* RunEngine:
******* Product: c:\wazuh-agent-4.12.0-1.msi
******* Action:
******* CommandLine: **********
MSI (s) (60:9C) [18:33:50:596]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (60:9C) [18:33:50:600]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (60:9C) [18:33:50:600]: SRSetRestorePoint skipped for this transaction.
MSI (s) (60:9C) [18:33:50:602]: File will have security applied from OpCode.
MSI (s) (60:9C) [18:33:50:607]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'c:\wazuh-agent-4.12.0-1.msi' against software restriction policy
MSI (s) (60:9C) [18:33:50:607]: SOFTWARE RESTRICTION POLICY: c:\wazuh-agent-4.12.0-1.msi has a digital signature
MSI (s) (60:9C) [18:33:50:651]: SOFTWARE RESTRICTION POLICY: c:\wazuh-agent-4.12.0-1.msi is permitted to run at the 'unrestricted' authorization level.
MSI (s) (60:9C) [18:33:50:651]: MSCOREE not loaded loading copy from system32
MSI (s) (60:9C) [18:33:50:653]: End dialog not enabled
MSI (s) (60:9C) [18:33:50:653]: Original package ==> c:\wazuh-agent-4.12.0-1.msi
MSI (s) (60:9C) [18:33:50:653]: Package we're running from ==> c:\Windows\Installer\e2009.msi
MSI (s) (60:9C) [18:33:50:655]: APPCOMPAT: Compatibility mode property overrides found.
MSI (s) (60:9C) [18:33:50:655]: APPCOMPAT: looking for appcompat database entry with ProductCode '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (60:9C) [18:33:50:655]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (60:9C) [18:33:50:657]: Machine policy value 'TransformsSecure' is 0
MSI (s) (60:9C) [18:33:50:657]: User policy value 'TransformsAtSource' is 0
MSI (s) (60:9C) [18:33:50:657]: Machine policy value 'DisablePatch' is 0
MSI (s) (60:9C) [18:33:50:657]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (60:9C) [18:33:50:657]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (60:9C) [18:33:50:657]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (60:9C) [18:33:50:663]: APPCOMPAT: looking for appcompat database entry with ProductCode '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (60:9C) [18:33:50:663]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (60:9C) [18:33:50:663]: Transforms are not secure.
MSI (s) (60:9C) [18:33:50:663]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'c:\install.log'.
MSI (s) (60:9C) [18:33:50:663]: Command Line: WAZUH_MANAGER=192.168.100.18 CURRENTDIRECTORY=c:\ CLIENTUILEVEL=3 CLIENTPROCESSID=2824
MSI (s) (60:9C) [18:33:50:663]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{8D57269C-2008-4289-AD64-3C477FEA0843}'.
MSI (s) (60:9C) [18:33:50:663]: Product Code passed to Engine.Initialize: ''
MSI (s) (60:9C) [18:33:50:663]: Product Code from property table before transforms: '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'
MSI (s) (60:9C) [18:33:50:663]: Product Code from property table after transforms: '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'
MSI (s) (60:9C) [18:33:50:663]: Product not registered: beginning first-time install
MSI (s) (60:9C) [18:33:50:663]: Product {80B7D7ED-A637-46F3-96FC-2F9EA44F9886} is not managed.
MSI (s) (60:9C) [18:33:50:663]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (60:9C) [18:33:50:663]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (s) (60:9C) [18:33:50:663]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (60:9C) [18:33:50:663]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (60:9C) [18:33:50:663]: Adding new sources is allowed.
MSI (s) (60:9C) [18:33:50:663]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (s) (60:9C) [18:33:50:663]: Package name extracted from package path: 'wazuh-agent-4.12.0-1.msi'
MSI (s) (60:9C) [18:33:50:663]: Package to be registered: 'wazuh-agent-4.12.0-1.msi'
MSI (s) (60:9C) [18:33:50:665]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (60:9C) [18:33:50:665]: Machine policy value 'DisableMsi' is 0
MSI (s) (60:9C) [18:33:50:665]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (60:9C) [18:33:50:665]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (60:9C) [18:33:50:665]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (s) (60:9C) [18:33:50:665]: Running product '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}' with elevated privileges: Product is assigned.
MSI (s) (60:9C) [18:33:50:665]: PROPERTY CHANGE: Adding WAZUH_MANAGER property. Its value is '192.168.100.18'.
MSI (s) (60:9C) [18:33:50:665]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'c:\'.
MSI (s) (60:9C) [18:33:50:665]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (60:9C) [18:33:50:665]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '2824'.
MSI (s) (60:9C) [18:33:50:665]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (60:9C) [18:33:50:665]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (60:9C) [18:33:50:665]: TRANSFORMS property is now:
MSI (s) (60:9C) [18:33:50:666]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Favorites
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Documents
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Local
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Pictures
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (60:9C) [18:33:50:667]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (60:9C) [18:33:50:683]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (60:9C) [18:33:50:683]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (60:9C) [18:33:50:683]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Desktop
MSI (s) (60:9C) [18:33:50:683]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (60:9C) [18:33:50:683]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (s) (60:9C) [18:33:50:683]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (60:9C) [18:33:50:683]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (60:9C) [18:33:50:683]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (60:9C) [18:33:50:683]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (60:9C) [18:33:50:683]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (60:9C) [18:33:50:683]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
MSI (s) (60:9C) [18:33:50:683]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (60:9C) [18:33:50:683]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'c:\Windows\Installer\e2009.msi'.
MSI (s) (60:9C) [18:33:50:683]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'c:\wazuh-agent-4.12.0-1.msi'.
MSI (s) (60:9C) [18:33:50:683]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (60:9C) [18:33:50:683]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (60:9C) [18:33:50:694]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (60:9C) [18:33:50:694]: Machine policy value 'DisableRollback' is 0
MSI (s) (60:9C) [18:33:50:694]: User policy value 'DisableRollback' is 0
MSI (s) (60:9C) [18:33:50:694]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 14.05.2025 18:33:50 ===
MSI (s) (60:9C) [18:33:50:695]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (60:9C) [18:33:50:695]: Note: 1: 2205 2: 3: LaunchCondition
MSI (s) (60:9C) [18:33:50:695]: Note: 1: 2228 2: 3: LaunchCondition 4: SELECT `Condition` FROM `LaunchCondition`
MSI (s) (60:9C) [18:33:50:695]: APPCOMPAT: [DetectVersionLaunchCondition] Failed to initialize pRecErr.
MSI (s) (60:9C) [18:33:50:695]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (60:9C) [18:33:50:695]: Doing action: INSTALL
MSI (s) (60:9C) [18:33:50:695]: Note: 1: 2205 2: 3: ActionText
Action start 18:33:50: INSTALL.
MSI (s) (60:9C) [18:33:50:696]: Running ExecuteSequence
MSI (s) (60:9C) [18:33:50:696]: Doing action: FindRelatedProducts
MSI (s) (60:9C) [18:33:50:696]: Note: 1: 2205 2: 3: ActionText
Action start 18:33:50: FindRelatedProducts.
MSI (s) (60:9C) [18:33:50:697]: PROPERTY CHANGE: Adding WIX_UPGRADE_DETECTED property. Its value is '{4612144F-DAED-447A-A7E9-7483C78EF093}'.
MSI (s) (60:9C) [18:33:50:697]: PROPERTY CHANGE: Adding MIGRATE property. Its value is '{4612144F-DAED-447A-A7E9-7483C78EF093}'.
MSI (s) (60:9C) [18:33:50:697]: Doing action: CheckSvcRunning
MSI (s) (60:9C) [18:33:50:697]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:50: FindRelatedProducts. Return value 1.
MSI (s) (60:40) [18:33:50:698]: Generating random cookie.
MSI (s) (60:40) [18:33:50:709]: Created Custom Action Server with PID 4092 (0xFFC).
MSI (s) (60:00) [18:33:50:745]: Running as a service.
MSI (s) (60:00) [18:33:50:748]: Hello, I'm your 32bit Impersonated custom action server.
Action start 18:33:50: CheckSvcRunning.
MSI (s) (60:9C) [18:33:51:351]: Doing action: AppSearch
MSI (s) (60:9C) [18:33:51:351]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CheckSvcRunning. Return value 0.
Action start 18:33:51: AppSearch.
MSI (s) (60:9C) [18:33:51:352]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (60:9C) [18:33:51:352]: PROPERTY CHANGE: Modifying MAJORVERSION property. Its current value is '0'. Its new value: '#10'.
MSI (s) (60:9C) [18:33:51:352]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (60:9C) [18:33:51:352]: PROPERTY CHANGE: Modifying BUILDVERSION property. Its current value is '0'. Its new value: '19045'.
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Wazuh, Inc.\Wazuh Agent 3: 2
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\System\CurrentControlSet\Services\OssecSvc 3: 2
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (60:9C) [18:33:51:353]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\System\CurrentControlSet\Services\WazuhSvc 3: 2
MSI (s) (60:9C) [18:33:51:354]: Doing action: ValidateProductID
MSI (s) (60:9C) [18:33:51:354]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: AppSearch. Return value 1.
Action start 18:33:51: ValidateProductID.
MSI (s) (60:9C) [18:33:51:355]: Doing action: CostInitialize
MSI (s) (60:9C) [18:33:51:355]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: ValidateProductID. Return value 1.
MSI (s) (60:9C) [18:33:51:356]: Machine policy value 'MaxPatchCacheSize' is 10
Action start 18:33:51: CostInitialize.
MSI (s) (60:9C) [18:33:51:358]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'D:\'.
MSI (s) (60:9C) [18:33:51:358]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: Patch
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: __MsiPatchFileList
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: Patch
MSI (s) (60:9C) [18:33:51:359]: Doing action: FileCost
MSI (s) (60:9C) [18:33:51:359]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CostInitialize. Return value 1.
MSI (s) (60:9C) [18:33:51:360]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (60:9C) [18:33:51:360]: Note: 1: 2205 2: 3: Class
MSI (s) (60:9C) [18:33:51:360]: Note: 1: 2205 2: 3: Extension
MSI (s) (60:9C) [18:33:51:360]: Note: 1: 2205 2: 3: TypeLib
Action start 18:33:51: FileCost.
MSI (s) (60:9C) [18:33:51:360]: Doing action: WixSetDefaultPerUserFolder
MSI (s) (60:9C) [18:33:51:360]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: FileCost. Return value 1.
MSI (s) (60:9C) [18:33:51:361]: PROPERTY CHANGE: Adding WixPerUserFolder property. Its value is 'C:\Users\admin_user\AppData\Local\Apps\ossec-agent'.
Action start 18:33:51: WixSetDefaultPerUserFolder.
MSI (s) (60:9C) [18:33:51:361]: Doing action: WixSetDefaultPerMachineFolder
MSI (s) (60:9C) [18:33:51:361]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixSetDefaultPerUserFolder. Return value 1.
MSI (s) (60:9C) [18:33:51:361]: PROPERTY CHANGE: Adding WixPerMachineFolder property. Its value is 'C:\Program Files (x86)\ossec-agent'.
Action start 18:33:51: WixSetDefaultPerMachineFolder.
MSI (s) (60:9C) [18:33:51:362]: Skipping action: WixSetPerUserFolder (condition is false)
MSI (s) (60:9C) [18:33:51:362]: Doing action: WixSetPerMachineFolder
MSI (s) (60:9C) [18:33:51:362]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixSetDefaultPerMachineFolder. Return value 1.
MSI (s) (60:9C) [18:33:51:362]: PROPERTY CHANGE: Adding APPLICATIONFOLDER property. Its value is 'C:\Program Files (x86)\ossec-agent'.
Action start 18:33:51: WixSetPerMachineFolder.
MSI (s) (60:9C) [18:33:51:362]: Doing action: CostFinalize
MSI (s) (60:9C) [18:33:51:362]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixSetPerMachineFolder. Return value 1.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
MSI (s) (60:9C) [18:33:51:363]: Note: 1: 2205 2: 3: Patch
MSI (s) (60:9C) [18:33:51:363]: Note: 1: 2205 2: 3: Condition
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'D:\'.
MSI (s) (60:9C) [18:33:51:363]: PROPERTY CHANGE: Modifying WindowsFolder property. Its current value is 'C:\Windows\'. Its new value: 'c:\Windows\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Modifying ProgramMenuFolder property. Its current value is 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\'. Its new value: 'c:\ProgramData\Microsoft\Windows\Start Menu\Programs\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding ProgramMenuDir property. Its value is 'c:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Modifying ProgramFilesFolder property. Its current value is 'C:\Program Files (x86)\'. Its new value: 'c:\Program Files (x86)\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Modifying APPLICATIONFOLDER property. Its current value is 'C:\Program Files (x86)\ossec-agent'. Its new value: 'c:\Program Files (x86)\ossec-agent\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding UPGRADE property. Its value is 'c:\Program Files (x86)\ossec-agent\upgrade\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding INCOMING property. Its value is 'c:\Program Files (x86)\ossec-agent\incoming\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding SYSCHECK property. Its value is 'c:\Program Files (x86)\ossec-agent\syscheck\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding RIDS property. Its value is 'c:\Program Files (x86)\ossec-agent\rids\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding WODLES property. Its value is 'c:\Program Files (x86)\ossec-agent\wodles\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding LOGS property. Its value is 'c:\Program Files (x86)\ossec-agent\logs\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding BOOKMARKS property. Its value is 'c:\Program Files (x86)\ossec-agent\bookmarks\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding TMP property. Its value is 'c:\Program Files (x86)\ossec-agent\tmp\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding QUEUE property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding LOGCOLLECTOR property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\logcollector\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding FIM property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\fim\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding FIM_DB property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\fim\db\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding DIFF property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\diff\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding SYSCOLLECTOR property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\syscollector\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding SYSCOLLECTOR_DB property. Its value is 'c:\Program Files (x86)\ossec-agent\queue\syscollector\db\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding RULESET property. Its value is 'c:\Program Files (x86)\ossec-agent\ruleset\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding SECURITY_CONFIGURATION_ASSESSMENT property. Its value is 'c:\Program Files (x86)\ossec-agent\ruleset\sca\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding SHARED property. Its value is 'c:\Program Files (x86)\ossec-agent\shared\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding ACTIVE_RESPONSE property. Its value is 'c:\Program Files (x86)\ossec-agent\active-response\'.
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding BIN property. Its value is 'c:\Program Files (x86)\ossec-agent\active-response\bin\'.
MSI (s) (60:9C) [18:33:51:364]: Target path resolution complete. Dumping Directory table...
MSI (s) (60:9C) [18:33:51:364]: Note: target paths subject to change (via custom actions or browsing)
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: TARGETDIR , Object: D:\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: WindowsFolder , Object: c:\Windows\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: ProgramMenuFolder , Object: c:\ProgramData\Microsoft\Windows\Start Menu\Programs\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: ProgramMenuDir , Object: c:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: ProgramFilesFolder , Object: c:\Program Files (x86)\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: APPLICATIONFOLDER , Object: c:\Program Files (x86)\ossec-agent\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: UPGRADE , Object: c:\Program Files (x86)\ossec-agent\upgrade\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: INCOMING , Object: c:\Program Files (x86)\ossec-agent\incoming\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: SYSCHECK , Object: c:\Program Files (x86)\ossec-agent\syscheck\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: RIDS , Object: c:\Program Files (x86)\ossec-agent\rids\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: WODLES , Object: c:\Program Files (x86)\ossec-agent\wodles\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: LOGS , Object: c:\Program Files (x86)\ossec-agent\logs\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: BOOKMARKS , Object: c:\Program Files (x86)\ossec-agent\bookmarks\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: TMP , Object: c:\Program Files (x86)\ossec-agent\tmp\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: QUEUE , Object: c:\Program Files (x86)\ossec-agent\queue\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: LOGCOLLECTOR , Object: c:\Program Files (x86)\ossec-agent\queue\logcollector\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: FIM , Object: c:\Program Files (x86)\ossec-agent\queue\fim\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: FIM_DB , Object: c:\Program Files (x86)\ossec-agent\queue\fim\db\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: DIFF , Object: c:\Program Files (x86)\ossec-agent\queue\diff\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: SYSCOLLECTOR , Object: c:\Program Files (x86)\ossec-agent\queue\syscollector\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: SYSCOLLECTOR_DB , Object: c:\Program Files (x86)\ossec-agent\queue\syscollector\db\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: RULESET , Object: c:\Program Files (x86)\ossec-agent\ruleset\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: SECURITY_CONFIGURATION_ASSESSMENT , Object: c:\Program Files (x86)\ossec-agent\ruleset\sca\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: SHARED , Object: c:\Program Files (x86)\ossec-agent\shared\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: ACTIVE_RESPONSE , Object: c:\Program Files (x86)\ossec-agent\active-response\
MSI (s) (60:9C) [18:33:51:364]: Dir (target): Key: BIN , Object: c:\Program Files (x86)\ossec-agent\active-response\bin\
MSI (s) (60:9C) [18:33:51:364]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
MSI (s) (60:9C) [18:33:51:364]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (60:9C) [18:33:51:364]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
Action start 18:33:51: CostFinalize.
MSI (s) (60:9C) [18:33:51:366]: Doing action: MigrateFeatureStates
MSI (s) (60:9C) [18:33:51:366]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CostFinalize. Return value 1.
MSI (s) (60:9C) [18:33:51:366]: Migrating feature settings from product(s) '{4612144F-DAED-447A-A7E9-7483C78EF093}'
MSI (s) (60:9C) [18:33:51:366]: MigrateFeatureStates: based on existing product, setting feature 'MainFeature' to 'Absent' state.
Action start 18:33:51: MigrateFeatureStates.
MSI (s) (60:9C) [18:33:51:367]: Doing action: InstallValidate
MSI (s) (60:9C) [18:33:51:367]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: MigrateFeatureStates. Return value 1.
MSI (s) (60:9C) [18:33:51:367]: Feature: MainFeature; Installed: Absent; Request: Absent; Action: Absent
MSI (s) (60:9C) [18:33:51:367]: Component: REGISTRY_INSTALL_DIR; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: AGENT_AUTH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LIBWAZUHEXT_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LIBWAZUHSHARED_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: DBSYNC_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: RSYNC_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: SYSINFO_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: SYSCOLLECTOR_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: FIMDB_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LOCAL_INTERNAL_OPTIONS.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: OSSEC.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: INTERNAL_OPTIONS.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LICENSE.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LIBWINPTHREAD_1.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LIBGCC_S_DW2_1.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: LIBSTDCPP_6.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: MANAGE_AGENTS.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WAZUH_AGENT_EVENTCHANNEL.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WAZUH_AGENT.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: VISTA_SEC.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WIN32UI.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: REMOVE_OLD_NSIS; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: HELP_WIN.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: VERSION.JSON; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WPK_ROOT.PEM; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WXP_CONF_LOCALFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WXP_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: WXP_CONF_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:367]: Component: W2003_CONF_LOCALFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2003_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2003_CONF_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: WVISTA_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2008_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W7_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2008R2_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W8_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2012_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W8.1_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2012R2_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W10_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2016_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: W2019_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: RESTART_WAZUH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: ROUTE_NULL.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: NETSH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: REMOVE_OLD_AR; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: ACTIVE_RESPONSES.LOG; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: ROOTKIT_FILES.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: ROOTKIT_TROJANS.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: WIN_APPLICATIONS_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: WIN_AUDIT_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: WIN_MALWARE_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: REMOVE_OLD_POLICIES; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN10; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN11; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2012R2; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2012NONR2; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2016; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2019; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2022; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SCA_WIN2025; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: SYSCOLLECTOR_NORM_CONFIG; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: StartMenuShortcuts; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_ACTIVE_RESPONSE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_TMP; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_QUEUE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_DIFF; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_FIM; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_FIM_DB; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_SYSCOLLECTOR; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_SYSCOLLECTOR_DB; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_LOGCOLLECTOR; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_RULESET; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_SECURITY_CONFIGURATION_ASSESSMENT; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_BOOKMARKS; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_LOGS; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_WODLES; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_RIDS; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_INCOMING; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_UPGRADE; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: CMP_SHARED; Installed: Absent; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: __REGISTRY_INSTALL_DIR65; Installed: Null; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Component: __StartMenuShortcuts65; Installed: Null; Request: Null; Action: Null
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: BindImage
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: ProgId
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: Extension
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: Font
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: Class
MSI (s) (60:9C) [18:33:51:368]: Note: 1: 2205 2: 3: TypeLib
Action start 18:33:51: InstallValidate.
MSI (s) (60:9C) [18:33:51:375]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: BindImage
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: ProgId
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: Extension
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: Font
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: Class
MSI (s) (60:9C) [18:33:51:375]: Note: 1: 2205 2: 3: TypeLib
MSI (s) (60:9C) [18:33:51:376]: Note: 1: 2727 2:
MSI (s) (60:9C) [18:33:51:376]: Note: 1: 2727 2:
MSI (s) (60:9C) [18:33:51:376]: PROPERTY CHANGE: Adding REMOVE property. Its value is 'ALL'.
MSI (s) (60:9C) [18:33:51:377]: Doing action: InstallInitialize
MSI (s) (60:9C) [18:33:51:377]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: InstallValidate. Return value 1.
MSI (s) (60:9C) [18:33:51:377]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (60:9C) [18:33:51:377]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (60:9C) [18:33:51:377]: BeginTransaction: Locking Server
MSI (s) (60:9C) [18:33:51:378]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (60:9C) [18:33:51:378]: SRSetRestorePoint skipped for this transaction.
MSI (s) (60:9C) [18:33:51:378]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (60:9C) [18:33:51:378]: Server not locked: locking for product {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
Action start 18:33:51: InstallInitialize.
MSI (s) (60:9C) [18:33:51:381]: Doing action: RemoveExistingProducts
MSI (s) (60:9C) [18:33:51:381]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: InstallInitialize. Return value 1.
MSI (s) (60:9C) [18:33:51:381]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstall
Action start 18:33:51: RemoveExistingProducts.
MSI (s) (60:9C) [18:33:51:381]: Doing action: SetCustomActionDataForSetWazuhPermissions
MSI (s) (60:9C) [18:33:51:381]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RemoveExistingProducts. Return value 0.
MSI (s) (60:9C) [18:33:51:382]: PROPERTY CHANGE: Adding SetWazuhPermissions property. Its value is '"c:\Program Files (x86)\ossec-agent\"'.
Action start 18:33:51: SetCustomActionDataForSetWazuhPermissions.
MSI (s) (60:9C) [18:33:51:382]: Doing action: SetWazuhPermissions
MSI (s) (60:9C) [18:33:51:382]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: SetCustomActionDataForSetWazuhPermissions. Return value 1.
MSI (s) (60:9C) [18:33:51:382]: Note: 1: 2205 2: 3: MsiPatchCertificate
MSI (s) (60:9C) [18:33:51:382]: LUA patching is disabled: missing MsiPatchCertificate table
MSI (s) (60:9C) [18:33:51:382]: Resolving source.
MSI (s) (60:9C) [18:33:51:382]: Resolving source to launched-from source.
MSI (s) (60:9C) [18:33:51:382]: Setting launched-from source as last-used.
MSI (s) (60:9C) [18:33:51:382]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'c:\'.
MSI (s) (60:9C) [18:33:51:382]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'c:\'.
MSI (s) (60:9C) [18:33:51:382]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (60:9C) [18:33:51:382]: SOURCEDIR ==> c:\
MSI (s) (60:9C) [18:33:51:382]: SOURCEDIR product ==> {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (60:9C) [18:33:51:383]: Determining source type
MSI (s) (60:9C) [18:33:51:383]: Source type from package 'wazuh-agent-4.12.0-1.msi': 2
MSI (s) (60:9C) [18:33:51:383]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (60:9C) [18:33:51:383]: SECREPAIR: SourceHash database file already exists. Deleting it.
MSI (s) (60:9C) [18:33:51:384]: Note: 1: 2262 2: SourceHash 3: -2147287038
MSI (s) (60:9C) [18:33:51:386]: SECREPAIR: New Hash Database creation complete.
MSI (s) (60:9C) [18:33:51:413]: Source path resolution complete. Dumping Directory table...
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: TARGETDIR , Object: c:\ , LongSubPath: , ShortSubPath:
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: WindowsFolder , Object: c:\ , LongSubPath: , ShortSubPath:
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: ProgramMenuFolder , Object: c:\ , LongSubPath: , ShortSubPath:
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: ProgramMenuDir , Object: c:\ , LongSubPath: OSSEC\ , ShortSubPath:
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: ProgramFilesFolder , Object: c:\ , LongSubPath: PFiles\ , ShortSubPath:
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: APPLICATIONFOLDER , Object: c:\ , LongSubPath: PFiles\ossec-agent\ , ShortSubPath: PFiles\fjokbowa\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: UPGRADE , Object: c:\ , LongSubPath: PFiles\ossec-agent\upgrade\ , ShortSubPath: PFiles\fjokbowa\upgrade\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: INCOMING , Object: c:\ , LongSubPath: PFiles\ossec-agent\incoming\ , ShortSubPath: PFiles\fjokbowa\incoming\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: SYSCHECK , Object: c:\ , LongSubPath: PFiles\ossec-agent\syscheck\ , ShortSubPath: PFiles\fjokbowa\syscheck\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: RIDS , Object: c:\ , LongSubPath: PFiles\ossec-agent\rids\ , ShortSubPath: PFiles\fjokbowa\rids\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: WODLES , Object: c:\ , LongSubPath: PFiles\ossec-agent\wodles\ , ShortSubPath: PFiles\fjokbowa\wodles\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: LOGS , Object: c:\ , LongSubPath: PFiles\ossec-agent\logs\ , ShortSubPath: PFiles\fjokbowa\logs\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: BOOKMARKS , Object: c:\ , LongSubPath: PFiles\ossec-agent\bookmarks\ , ShortSubPath: PFiles\fjokbowa\ecn_axgq\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: TMP , Object: c:\ , LongSubPath: PFiles\ossec-agent\tmp\ , ShortSubPath: PFiles\fjokbowa\tmp\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: QUEUE , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\ , ShortSubPath: PFiles\fjokbowa\queue\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: LOGCOLLECTOR , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\logcollector\ , ShortSubPath: PFiles\fjokbowa\queue\c-7jkeo6\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: FIM , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\fim\ , ShortSubPath: PFiles\fjokbowa\queue\fim\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: FIM_DB , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\fim\db\ , ShortSubPath: PFiles\fjokbowa\queue\fim\db\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: DIFF , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\diff\ , ShortSubPath: PFiles\fjokbowa\queue\diff\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: SYSCOLLECTOR , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\syscollector\ , ShortSubPath: PFiles\fjokbowa\queue\bnp5_md3\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: SYSCOLLECTOR_DB , Object: c:\ , LongSubPath: PFiles\ossec-agent\queue\syscollector\db\ , ShortSubPath: PFiles\fjokbowa\queue\bnp5_md3\db\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: RULESET , Object: c:\ , LongSubPath: PFiles\ossec-agent\ruleset\ , ShortSubPath: PFiles\fjokbowa\ruleset\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: SECURITY_CONFIGURATION_ASSESSMENT , Object: c:\ , LongSubPath: PFiles\ossec-agent\ruleset\sca\ , ShortSubPath: PFiles\fjokbowa\ruleset\sca\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: SHARED , Object: c:\ , LongSubPath: PFiles\ossec-agent\shared\ , ShortSubPath: PFiles\fjokbowa\shared\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: ACTIVE_RESPONSE , Object: c:\ , LongSubPath: PFiles\ossec-agent\active-response\ , ShortSubPath: PFiles\fjokbowa\9pxtresz\
MSI (s) (60:9C) [18:33:51:413]: Dir (source): Key: BIN , Object: c:\ , LongSubPath: PFiles\ossec-agent\active-response\bin\ , ShortSubPath: PFiles\fjokbowa\9pxtresz\bin\
MSI (s) (60:9C) [18:33:51:413]: Note: 1: 2205 2: 3: ActionText
MSI (s) (60:9C) [18:33:51:413]: Note: 1: 2205 2: 3: ActionText
MSI (s) (60:9C) [18:33:51:418]: Note: 1: 2205 2: 3: ActionText
Action start 18:33:51: SetWazuhPermissions.
MSI (s) (60:9C) [18:33:51:421]: Skipping action: SetAgentGroup (condition is false)
MSI (s) (60:9C) [18:33:51:421]: Skipping action: SetAgentName (condition is false)
MSI (s) (60:9C) [18:33:51:421]: Skipping action: SetOSVersion0 (condition is false)
MSI (s) (60:9C) [18:33:51:421]: Skipping action: SetOSVersion1 (condition is false)
MSI (s) (60:9C) [18:33:51:421]: Doing action: SetOSVersion10
MSI (s) (60:9C) [18:33:51:421]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: SetWazuhPermissions. Return value 1.
MSI (s) (60:9C) [18:33:51:422]: PROPERTY CHANGE: Adding OS_VERSION property. Its value is '10'.
Action start 18:33:51: SetOSVersion10.
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion11 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion12 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion2 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion3 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion4 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion5 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion6 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion7 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion8 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetOSVersion9 (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationCA (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationCertificate (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationKet (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationPassword (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationPort (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetRegistrationServer (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetWazuhKeepAlive (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetWazuhManager (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetWazuhManagerPort (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetWazuhManagerProtocol (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetWazuhTimeReconnect (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: SetCustomActionDataValue (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: CustomAction_InstallerScripts (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: StopOssecService (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Skipping action: DeleteOssecService (condition is false)
MSI (s) (60:9C) [18:33:51:422]: Doing action: ProcessComponents
MSI (s) (60:9C) [18:33:51:422]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: SetOSVersion10. Return value 1.
Action start 18:33:51: ProcessComponents.
MSI (s) (60:9C) [18:33:51:423]: Doing action: UnpublishFeatures
MSI (s) (60:9C) [18:33:51:423]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: ProcessComponents. Return value 1.
Action start 18:33:51: UnpublishFeatures.
MSI (s) (60:9C) [18:33:51:424]: Doing action: SchedSecureObjectsRollback
MSI (s) (60:9C) [18:33:51:424]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: UnpublishFeatures. Return value 1.
MSI (s) (60:B4) [18:33:51:426]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI2F03.tmp, Entrypoint: SchedSecureObjectsRollback
Action start 18:33:51: SchedSecureObjectsRollback.
MSI (s) (60!E4) [18:33:51:431]: Note: 1: 2753 2: OSSEC.CONF
MSI (s) (60!E4) [18:33:51:431]: Note: 1: 2753 2: OSSEC.CONF
SchedSecureObjectsRollback: Entering SchedSecureObjectsRollback in C:\Windows\Installer\MSI2F03.tmp, version 3.11.4516.0
SchedSecureObjectsRollback: Error 0x8007007b: Unable to schedule rollback for object:
SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x8007007b - continuing
MSI (s) (60:9C) [18:33:51:434]: Doing action: StopServices
MSI (s) (60:9C) [18:33:51:434]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: SchedSecureObjectsRollback. Return value 1.
Action start 18:33:51: StopServices.
MSI (s) (60:9C) [18:33:51:436]: Doing action: DeleteServices
MSI (s) (60:9C) [18:33:51:436]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: StopServices. Return value 1.
Action start 18:33:51: DeleteServices.
MSI (s) (60:9C) [18:33:51:437]: Doing action: RemoveRegistryValues
MSI (s) (60:9C) [18:33:51:437]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: DeleteServices. Return value 1.
Action start 18:33:51: RemoveRegistryValues.
MSI (s) (60:9C) [18:33:51:439]: Doing action: RemoveShortcuts
MSI (s) (60:9C) [18:33:51:439]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RemoveRegistryValues. Return value 1.
Action start 18:33:51: RemoveShortcuts.
MSI (s) (60:9C) [18:33:51:440]: Doing action: RemoveFiles
MSI (s) (60:9C) [18:33:51:440]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RemoveShortcuts. Return value 1.
Action start 18:33:51: RemoveFiles.
MSI (s) (60:9C) [18:33:51:441]: Doing action: WixSchedInternetShortcuts
MSI (s) (60:9C) [18:33:51:441]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RemoveFiles. Return value 1.
MSI (s) (60:8C) [18:33:51:442]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI2F23.tmp, Entrypoint: WixSchedInternetShortcuts
Action start 18:33:51: WixSchedInternetShortcuts.
WixSchedInternetShortcuts: Entering WixSchedInternetShortcuts in C:\Windows\Installer\MSI2F23.tmp, version 3.11.4516.0
WixSchedInternetShortcuts: Skipping shortcut for null-action component 'StartMenuShortcuts'
MSI (s) (60:9C) [18:33:51:463]: Doing action: RemoveFolders
MSI (s) (60:9C) [18:33:51:463]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixSchedInternetShortcuts. Return value 1.
Action start 18:33:51: RemoveFolders.
MSI (s) (60:9C) [18:33:51:464]: Doing action: CreateFolders
MSI (s) (60:9C) [18:33:51:465]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RemoveFolders. Return value 1.
Action start 18:33:51: CreateFolders.
MSI (s) (60:9C) [18:33:51:466]: Doing action: InstallFiles
MSI (s) (60:9C) [18:33:51:466]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CreateFolders. Return value 1.
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2205 2: 3: Patch
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (60:9C) [18:33:51:468]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
Action start 18:33:51: InstallFiles.
MSI (s) (60:9C) [18:33:51:471]: Doing action: CreateShortcuts
MSI (s) (60:9C) [18:33:51:471]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: InstallFiles. Return value 1.
MSI (s) (60:9C) [18:33:51:472]: Note: 1: 2205 2: 3: MsiShortcutProperty
MSI (s) (60:9C) [18:33:51:472]: Note: 1: 2205 2: 3: MsiShortcutProperty
Action start 18:33:51: CreateShortcuts.
MSI (s) (60:9C) [18:33:51:473]: Doing action: WixRollbackInternetShortcuts
MSI (s) (60:9C) [18:33:51:473]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CreateShortcuts. Return value 1.
Action start 18:33:51: WixRollbackInternetShortcuts.
MSI (s) (60:9C) [18:33:51:475]: Doing action: WixCreateInternetShortcuts
MSI (s) (60:9C) [18:33:51:475]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixRollbackInternetShortcuts. Return value 1.
Action start 18:33:51: WixCreateInternetShortcuts.
MSI (s) (60:9C) [18:33:51:478]: Doing action: WriteRegistryValues
MSI (s) (60:9C) [18:33:51:478]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WixCreateInternetShortcuts. Return value 1.
Action start 18:33:51: WriteRegistryValues.
MSI (s) (60:9C) [18:33:51:479]: Doing action: InstallServices
MSI (s) (60:9C) [18:33:51:479]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: WriteRegistryValues. Return value 1.
Action start 18:33:51: InstallServices.
MSI (s) (60:9C) [18:33:51:480]: Skipping action: SchedSecureObjects (condition is false)
MSI (s) (60:9C) [18:33:51:480]: Skipping action: StartWazuhSvc (condition is false)
MSI (s) (60:9C) [18:33:51:480]: Doing action: StartServices
MSI (s) (60:9C) [18:33:51:480]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: InstallServices. Return value 1.
Action start 18:33:51: StartServices.
MSI (s) (60:9C) [18:33:51:481]: Doing action: RegisterUser
MSI (s) (60:9C) [18:33:51:481]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: StartServices. Return value 1.
Action start 18:33:51: RegisterUser.
MSI (s) (60:9C) [18:33:51:482]: Doing action: RegisterProduct
MSI (s) (60:9C) [18:33:51:482]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RegisterUser. Return value 1.
Action start 18:33:51: RegisterProduct.
MSI (s) (60:9C) [18:33:51:482]: Doing action: PublishFeatures
MSI (s) (60:9C) [18:33:51:482]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: RegisterProduct. Return value 1.
Action start 18:33:51: PublishFeatures.
MSI (s) (60:9C) [18:33:51:483]: Doing action: PublishProduct
MSI (s) (60:9C) [18:33:51:483]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: PublishFeatures. Return value 1.
Action start 18:33:51: PublishProduct.
MSI (s) (60:9C) [18:33:51:484]: Doing action: CloseGUI
MSI (s) (60:9C) [18:33:51:484]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: PublishProduct. Return value 1.
Action start 18:33:51: CloseGUI.
MSI (s) (60:9C) [18:33:51:485]: Doing action: CreateDumpRegistryKey
MSI (s) (60:9C) [18:33:51:485]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CloseGUI. Return value 1.
Action start 18:33:51: CreateDumpRegistryKey.
MSI (s) (60:9C) [18:33:51:486]: Doing action: SetRemoveAllDataValue
MSI (s) (60:9C) [18:33:51:486]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CreateDumpRegistryKey. Return value 1.
MSI (s) (60:9C) [18:33:51:486]: PROPERTY CHANGE: Adding CustomAction_RemoveAllScript property. Its value is '"c:\Program Files (x86)\ossec-agent\"'.
Action start 18:33:51: SetRemoveAllDataValue.
MSI (s) (60:9C) [18:33:51:487]: Doing action: CustomAction_RemoveAllScript
MSI (s) (60:9C) [18:33:51:487]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: SetRemoveAllDataValue. Return value 1.
Action start 18:33:51: CustomAction_RemoveAllScript.
MSI (s) (60:9C) [18:33:51:487]: Doing action: InstallFinalize
MSI (s) (60:9C) [18:33:51:487]: Note: 1: 2205 2: 3: ActionText
Action ended 18:33:51: CustomAction_RemoveAllScript. Return value 1.
MSI (s) (60:9C) [18:33:51:488]: Running Script: C:\Windows\Installer\MSI2F02.tmp
MSI (s) (60:9C) [18:33:51:488]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (60:9C) [18:33:51:489]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (60:9C) [18:33:51:489]: Machine policy value 'DisableRollback' is 0
MSI (s) (60:9C) [18:33:51:489]: Note: 1: 2318 2:
MSI (s) (60:9C) [18:33:51:490]: Note: 1: 2318 2:
MSI (s) (60:9C) [18:33:51:490]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (60:9C) [18:33:51:491]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1521390650,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 18:33:51: InstallFinalize.
MSI (s) (60:9C) [18:33:51:491]: Executing op: ProductInfo(ProductKey={80B7D7ED-A637-46F3-96FC-2F9EA44F9886},ProductName=Wazuh Agent,PackageName=wazuh-agent-4.12.0-1.msi,Language=1033,Version=67895296,Assignment=1,ObsoleteArg=0,ProductIcon=icon.ico,,PackageCode={8D57269C-2008-4289-AD64-3C477FEA0843},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (60:9C) [18:33:51:491]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (60:9C) [18:33:51:491]: Executing op: DialogInfo(Type=1,Argument=Wazuh Agent)
MSI (s) (60:9C) [18:33:51:492]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (60:9C) [18:33:51:492]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (60:9C) [18:33:51:492]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (60:9C) [18:33:51:492]: Executing op: ActionStart(Name=SetWazuhPermissions,,)
MSI (s) (60:9C) [18:33:51:492]: Executing op: CustomActionSchedule(Action=SetWazuhPermissions,ActionType=3590,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripting
MSI (s) (60:9C) [18:33:51:492]: Executing op: ActionStart(Name=WixRollbackInternetShortcuts,,)
MSI (s) (60:9C) [18:33:51:492]: Executing op: CustomActionSchedule(Action=WixRollbackInternetShortcuts,ActionType=3329,Source=BinaryData,Target=WixRollbackInternetShortcuts,)
MSI (s) (60:9C) [18:33:51:493]: Executing op: ActionStart(Name=WixCreateInternetShortcuts,,)
MSI (s) (60:9C) [18:33:51:493]: Executing op: CustomActionSchedule(Action=WixCreateInternetShortcuts,ActionType=3073,Source=BinaryData,Target=WixCreateInternetShortcuts,)
MSI (s) (60:AC) [18:33:51:495]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI2F53.tmp, Entrypoint: WixCreateInternetShortcuts
MSI (s) (60:40) [18:33:51:495]: Generating random cookie.
MSI (s) (60:40) [18:33:51:505]: Created Custom Action Server with PID 4732 (0x127C).
MSI (s) (60:00) [18:33:51:538]: Running as a service.
MSI (s) (60:00) [18:33:51:541]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
MSI (s) (60:9C) [18:33:51:549]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)
WixCreateInternetShortcuts: Entering WixCreateInternetShortcuts in C:\Windows\Installer\MSI2F53.tmp, version 3.11.4516.0
MSI (s) (60:9C) [18:33:51:549]: Executing op: CleanupConfigData()
MSI (s) (60:9C) [18:33:51:550]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
MSI (s) (60:9C) [18:33:51:550]: Note: 1: 1402 2: UNKNOWN\Products\DE7D7B08736A3F6469CFF2E94AF48968\Patches 3: 2
MSI (s) (60:9C) [18:33:51:550]: Executing op: ActionStart(Name=CloseGUI,,)
MSI (s) (60:9C) [18:33:51:551]: Executing op: CustomActionSchedule(Action=CloseGUI,ActionType=3078,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripting.Dictionary
MSI (s) (60:9C) [18:33:51:738]: Executing op: ActionStart(Name=CreateDumpRegistryKey,,)
MSI (s) (60:9C) [18:33:51:738]: Executing op: CustomActionSchedule(Action=CreateDumpRegistryKey,ActionType=1030,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripti
MSI (s) (60:9C) [18:33:51:812]: Executing op: ActionStart(Name=CustomAction_RemoveAllScript,,)
MSI (s) (60:9C) [18:33:51:813]: Executing op: CustomActionSchedule(Action=CustomAction_RemoveAllScript,ActionType=3590,Source=' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------
' This function is called only when uninstalling the product.
' Remove everything, but a few specified items.
'
publi
MSI (s) (60:9C) [18:33:51:813]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (60:9C) [18:33:51:817]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (60:9C) [18:33:51:817]: User policy value 'DisableRollback' is 0
MSI (s) (60:9C) [18:33:51:817]: Machine policy value 'DisableRollback' is 0
MSI (s) (60:9C) [18:33:51:819]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (60:9C) [18:33:52:746]: Note: 1: 2318 2:
MSI (s) (60:9C) [18:33:52:748]: Note: 1: 2318 2:
MSI (s) (60:9C) [18:33:52:748]: No System Restore sequence number for this installation.
MSI (s) (60:9C) [18:33:52:748]: Unlocking Server
MSI (s) (60:9C) [18:33:52:758]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 18:33:52: InstallFinalize. Return value 1.
Action ended 18:33:52: INSTALL. Return value 1.
Property(S): UpgradeCode = {F495AC57-7BDE-4C4B-92D8-DBE40A9AA5A0}
Property(S): MAJORVERSION = #10
Property(S): BUILDVERSION = 19045
Property(S): APPLICATIONFOLDER = c:\Program Files (x86)\ossec-agent\
Property(S): GENERATE_DUMP = 1
Property(S): BIN = c:\Program Files (x86)\ossec-agent\active-response\bin\
Property(S): ACTIVE_RESPONSE = c:\Program Files (x86)\ossec-agent\active-response\
Property(S): SHARED = c:\Program Files (x86)\ossec-agent\shared\
Property(S): SECURITY_CONFIGURATION_ASSESSMENT = c:\Program Files (x86)\ossec-agent\ruleset\sca\
Property(S): SYSCOLLECTOR = c:\Program Files (x86)\ossec-agent\queue\syscollector\
Property(S): ProgramMenuDir = c:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\
Property(S): TMP = c:\Program Files (x86)\ossec-agent\tmp\
Property(S): QUEUE = c:\Program Files (x86)\ossec-agent\queue\
Property(S): DIFF = c:\Program Files (x86)\ossec-agent\queue\diff\
Property(S): FIM = c:\Program Files (x86)\ossec-agent\queue\fim\
Property(S): FIM_DB = c:\Program Files (x86)\ossec-agent\queue\fim\db\
Property(S): SYSCOLLECTOR_DB = c:\Program Files (x86)\ossec-agent\queue\syscollector\db\
Property(S): LOGCOLLECTOR = c:\Program Files (x86)\ossec-agent\queue\logcollector\
Property(S): RULESET = c:\Program Files (x86)\ossec-agent\ruleset\
Property(S): BOOKMARKS = c:\Program Files (x86)\ossec-agent\bookmarks\
Property(S): LOGS = c:\Program Files (x86)\ossec-agent\logs\
Property(S): WODLES = c:\Program Files (x86)\ossec-agent\wodles\
Property(S): RIDS = c:\Program Files (x86)\ossec-agent\rids\
Property(S): SYSCHECK = c:\Program Files (x86)\ossec-agent\syscheck\
Property(S): INCOMING = c:\Program Files (x86)\ossec-agent\incoming\
Property(S): UPGRADE = c:\Program Files (x86)\ossec-agent\upgrade\
Property(S): WixUIRMOption = UseRM
Property(S): WixAppFolder = WixPerMachineFolder
Property(S): WIXUI_INSTALLDIR = APPLICATIONFOLDER
Property(S): ALLUSERS = 1
Property(S): Privileged = 1
Property(S): ARPNOMODIFY = yes
Property(S): ARPNOREPAIR = yes
Property(S): WixPerUserFolder = C:\Users\admin_user\AppData\Local\Apps\ossec-agent
Property(S): OS_VERSION = 10
Property(S): WAZUH_MANAGER = 192.168.100.18
Property(S): CustomAction_RemoveAllScript = "c:\Program Files (x86)\ossec-agent\"
Property(S): SetWazuhPermissions = "c:\Program Files (x86)\ossec-agent\"
Property(S): WixPerMachineFolder = C:\Program Files (x86)\ossec-agent
Property(S): ProgramFilesFolder = c:\Program Files (x86)\
Property(S): TARGETDIR = D:\
Property(S): ProgramMenuFolder = c:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(S): SourceDir = c:\
Property(S): VersionNT = 603
Property(S): MSIRESTARTMANAGERCONTROL = Disable
Property(S): MsiLogging = v
Property(S): ARPPRODUCTICON = icon.ico
Property(S): WIXUI_EXITDIALOGOPTIONALCHECKBOXTEXT = Run Agent configuration interface
Property(S): DEFAULT_GENERATE_DUMP = 1
Property(S): ApplicationFolderName = ossec-agent
Property(S): WixShellExecTarget = [APPLICATIONFOLDER]win32ui.exe
Property(S): Manufacturer = Wazuh, Inc.
Property(S): ProductCode = {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
Property(S): ProductLanguage = 1033
Property(S): ProductName = Wazuh Agent
Property(S): ProductVersion = 4.12.0
Property(S): DefaultUIFont = WixUI_Font_Normal
Property(S): WixUI_Mode = Advanced
Property(S): ErrorDialog = ErrorDlg
Property(S): SecureCustomProperties = ADDRESS;AGENT_NAME;AUTHD_PORT;AUTHD_SERVER;CERTIFICATE;GROUP;KEY;NOTIFY_TIME;OS_VERSION;PASSWORD;PEM;PROTOCOL;SERVER_PORT;TIME_RECONNECT;WAZUH_AGENT_GROUP;WAZUH_AGENT_NAME;WAZUH_KEEP_ALIVE_INTERVAL;WAZUH_MANAGER;WAZUH_MANAGER_PORT;WAZUH_PROTOCOL;WAZUH_REGISTRATION_CA;WAZUH_REGISTRATION_CERTIFICATE;WAZUH_REGISTRATION_KEY;WAZUH_REGISTRATION_PASSWORD;WAZUH_REGISTRATION_PORT;WAZUH_REGISTRATION_SERVER;WAZUH_TIME_RECONNECT;WIX_UPGRADE_DETECTED
Property(S): MsiHiddenProperties = ExecSecureObjects;ExecSecureObjectsRollback
Property(S): WIX_UPGRADE_DETECTED = {4612144F-DAED-447A-A7E9-7483C78EF093}
Property(S): MsiLogFileLocation = c:\install.log
Property(S): PackageCode = {8D57269C-2008-4289-AD64-3C477FEA0843}
Property(S): ProductState = -1
Property(S): PackagecodeChanging = 1
Property(S): CURRENTDIRECTORY = c:\
Property(S): CLIENTUILEVEL = 3
Property(S): CLIENTPROCESSID = 2824
Property(S): VersionDatabase = 200
Property(S): VersionMsi = 5.00
Property(S): VersionNT64 = 603
Property(S): WindowsBuild = 9600
Property(S): ServicePackLevel = 0
Property(S): ServicePackLevelMinor = 0
Property(S): MsiNTProductType = 1
Property(S): WindowsFolder = c:\Windows\
Property(S): WindowsVolume = c:\
Property(S): System64Folder = C:\Windows\system32\
Property(S): SystemFolder = c:\Windows\SysWOW64\
Property(S): RemoteAdminTS = 1
Property(S): TempFolder = C:\Users\PSB-A-~1\AppData\Local\Temp\
Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
Property(S): ProgramFiles64Folder = C:\Program Files\
Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
Property(S): AppDataFolder = C:\Users\admin_user\AppData\Roaming\
Property(S): FavoritesFolder = C:\Users\admin_user\Favorites\
Property(S): NetHoodFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(S): PersonalFolder = C:\Users\admin_user\Documents\
Property(S): PrintHoodFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(S): RecentFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Recent\
Property(S): SendToFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\SendTo\
Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(S): CommonAppDataFolder = C:\ProgramData\
Property(S): LocalAppDataFolder = C:\Users\admin_user\AppData\Local\
Property(S): MyPicturesFolder = C:\Users\admin_user\Pictures\
Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(S): DesktopFolder = C:\Users\Public\Desktop\
Property(S): FontsFolder = C:\Windows\Fonts\
Property(S): GPTSupport = 1
Property(S): OLEAdvtSupport = 1
Property(S): ShellAdvtSupport = 1
Property(S): MsiAMD64 = 6
Property(S): Msix64 = 6
Property(S): Intel = 6
Property(S): PhysicalMemory = 8026
Property(S): VirtualMemory = 5914
Property(S): AdminUser = 1
Property(S): MsiTrueAdminUser = 1
Property(S): LogonUser = admin_user
Property(S): UserSID = S-1-5-21-2954139208-1844025400-3761949349-1274
Property(S): UserLanguageID = 1049
Property(S): ComputerName = PSAL0_TEST
Property(S): SystemLanguageID = 1049
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 19
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 18:33:52
Property(S): Date = 14.05.2025
Property(S): MsiNetAssemblySupport = 4.8.9037.0
Property(S): MsiWin32AssemblySupport = 6.3.19041.3636
Property(S): RedirectedDllSupport = 2
Property(S): MsiRunningElevated = 1
Property(S): USERNAME = user
Property(S): DATABASE = c:\Windows\Installer\e2009.msi
Property(S): OriginalDatabase = c:\wazuh-agent-4.12.0-1.msi
Property(S): UILevel = 2
Property(S): ACTION = INSTALL
Property(S): MIGRATE = {4612144F-DAED-447A-A7E9-7483C78EF093}
Property(S): ROOTDRIVE = D:\
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): INSTALLLEVEL = 1
Property(S): REMOVE = ALL
Property(S): SOURCEDIR = c:\
Property(S): SourcedirProduct = {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (60:9C) [18:33:52:777]: Note: 1: 1707
MSI (s) (60:9C) [18:33:52:778]: Product: Wazuh Agent -- Installation completed successfully.
MSI (s) (60:9C) [18:33:52:778]: Установщик Windows выполнил установку продукта. Продукт: Wazuh Agent. Версия: 4.12.0. Язык: 1033. Изготовитель: Wazuh, Inc.. Установка завершена с состоянием: 0.
MSI (s) (60:9C) [18:33:52:782]: Deferring clean up of packages/files, if any exist
MSI (s) (60:9C) [18:33:52:782]: MainEngineThread is returning 0
MSI (s) (60:D8) [18:33:52:783]: No System Restore sequence number for this installation.
=== Logging stopped: 14.05.2025 18:33:52 ===
MSI (s) (60:D8) [18:33:52:784]: User policy value 'DisableRollback' is 0
MSI (s) (60:D8) [18:33:52:784]: Machine policy value 'DisableRollback' is 0
MSI (s) (60:D8) [18:33:52:784]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (60:D8) [18:33:52:784]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (60:D8) [18:33:52:785]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (60:D8) [18:33:52:786]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (60:D8) [18:33:52:786]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (60:D8) [18:33:52:786]: Destroying RemoteAPI object.
MSI (s) (60:40) [18:33:52:786]: Custom Action Manager thread ending.
MSI (c) (08:BC) [18:33:52:788]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (08:BC) [18:33:52:788]: MainEngineThread is returning 0
=== Verbose logging stopped: 14.05.2025 18:33:52 ===
=== Verbose logging started: 14.05.2025 18:51:33 Build type: SHIP UNICODE 5.00.10011.00 Calling process: C:\Windows\system32\msiexec.exe ===
MSI (c) (C4:F4) [18:51:33:527]: Resetting cached policy values
MSI (c) (C4:F4) [18:51:33:527]: Machine policy value 'Debug' is 0
MSI (c) (C4:F4) [18:51:33:527]: ******* RunEngine:
******* Product: wazuh-agent-4.12.0-1.msi
******* Action:
******* CommandLine: **********
MSI (c) (C4:F4) [18:51:33:527]: Client-side and UI is none or basic: Running entire install on the server.
MSI (c) (C4:F4) [18:51:33:528]: Grabbed execution mutex.
MSI (c) (C4:F4) [18:51:33:532]: Cloaking enabled.
MSI (c) (C4:F4) [18:51:33:532]: Attempting to enable all disabled privileges before calling Install on Server
MSI (c) (C4:F4) [18:51:33:537]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (E0:C0) [18:51:33:546]: Running installation inside multi-package transaction C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi
MSI (s) (E0:C0) [18:51:33:546]: Grabbed execution mutex.
MSI (s) (E0:AC) [18:51:33:547]: Resetting cached policy values
MSI (s) (E0:AC) [18:51:33:547]: Machine policy value 'Debug' is 0
MSI (s) (E0:AC) [18:51:33:547]: ******* RunEngine:
******* Product: C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi
******* Action:
******* CommandLine: **********
MSI (s) (E0:AC) [18:51:33:547]: Machine policy value 'DisableUserInstalls' is 0
MSI (s) (E0:AC) [18:51:33:551]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (E0:AC) [18:51:33:552]: SRSetRestorePoint skipped for this transaction.
MSI (s) (E0:AC) [18:51:33:553]: File will have security applied from OpCode.
MSI (s) (E0:AC) [18:51:33:558]: SOFTWARE RESTRICTION POLICY: Verifying package --> 'C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi' against software restriction policy
MSI (s) (E0:AC) [18:51:33:558]: SOFTWARE RESTRICTION POLICY: C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi has a digital signature
MSI (s) (E0:AC) [18:51:33:591]: SOFTWARE RESTRICTION POLICY: C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi is permitted to run at the 'unrestricted' authorization level.
MSI (s) (E0:AC) [18:51:33:591]: MSCOREE not loaded loading copy from system32
MSI (s) (E0:AC) [18:51:33:594]: End dialog not enabled
MSI (s) (E0:AC) [18:51:33:594]: Original package ==> C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi
MSI (s) (E0:AC) [18:51:33:594]: Package we're running from ==> C:\Windows\Installer\21e70c.msi
MSI (s) (E0:AC) [18:51:33:595]: APPCOMPAT: Compatibility mode property overrides found.
MSI (s) (E0:AC) [18:51:33:595]: APPCOMPAT: looking for appcompat database entry with ProductCode '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (E0:AC) [18:51:33:595]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (E0:AC) [18:51:33:596]: Machine policy value 'TransformsSecure' is 0
MSI (s) (E0:AC) [18:51:33:596]: User policy value 'TransformsAtSource' is 0
MSI (s) (E0:AC) [18:51:33:596]: Machine policy value 'DisablePatch' is 0
MSI (s) (E0:AC) [18:51:33:596]: Machine policy value 'AllowLockdownPatch' is 0
MSI (s) (E0:AC) [18:51:33:596]: Machine policy value 'DisableLUAPatching' is 0
MSI (s) (E0:AC) [18:51:33:596]: Machine policy value 'DisableFlyWeightPatching' is 0
MSI (s) (E0:AC) [18:51:33:603]: APPCOMPAT: looking for appcompat database entry with ProductCode '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (E0:AC) [18:51:33:603]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (E0:AC) [18:51:33:603]: Transforms are not secure.
MSI (s) (E0:AC) [18:51:33:603]: PROPERTY CHANGE: Adding MsiLogFileLocation property. Its value is 'C:\Program Files (x86)\ossec-agent\install.log'.
MSI (s) (E0:AC) [18:51:33:603]: Command Line: WAZUH_MANAGER=192.168.100.18 CURRENTDIRECTORY=C:\Program Files (x86)\ossec-agent CLIENTUILEVEL=3 CLIENTPROCESSID=11972
MSI (s) (E0:AC) [18:51:33:603]: PROPERTY CHANGE: Adding PackageCode property. Its value is '{8D57269C-2008-4289-AD64-3C477FEA0843}'.
MSI (s) (E0:AC) [18:51:33:603]: Product Code passed to Engine.Initialize: ''
MSI (s) (E0:AC) [18:51:33:603]: Product Code from property table before transforms: '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'
MSI (s) (E0:AC) [18:51:33:603]: Product Code from property table after transforms: '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'
MSI (s) (E0:AC) [18:51:33:603]: Product not registered: beginning first-time install
MSI (s) (E0:AC) [18:51:33:603]: Product {80B7D7ED-A637-46F3-96FC-2F9EA44F9886} is not managed.
MSI (s) (E0:AC) [18:51:33:603]: MSI_LUA: Credential prompt not required, user is an admin
MSI (s) (E0:AC) [18:51:33:603]: PROPERTY CHANGE: Adding ProductState property. Its value is '-1'.
MSI (s) (E0:AC) [18:51:33:603]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (E0:AC) [18:51:33:603]: User policy value 'SearchOrder' is 'nmu'
MSI (s) (E0:AC) [18:51:33:603]: Adding new sources is allowed.
MSI (s) (E0:AC) [18:51:33:604]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is '1'.
MSI (s) (E0:AC) [18:51:33:604]: Package name extracted from package path: 'wazuh-agent-4.12.0-1.msi'
MSI (s) (E0:AC) [18:51:33:604]: Package to be registered: 'wazuh-agent-4.12.0-1.msi'
MSI (s) (E0:AC) [18:51:33:606]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (E0:AC) [18:51:33:606]: Machine policy value 'DisableMsi' is 0
MSI (s) (E0:AC) [18:51:33:606]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E0:AC) [18:51:33:606]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E0:AC) [18:51:33:607]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (s) (E0:AC) [18:51:33:607]: Running product '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}' with elevated privileges: Product is assigned.
MSI (s) (E0:AC) [18:51:33:607]: PROPERTY CHANGE: Adding WAZUH_MANAGER property. Its value is '192.168.100.18'.
MSI (s) (E0:AC) [18:51:33:607]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is 'C:\Program Files (x86)\ossec-agent'.
MSI (s) (E0:AC) [18:51:33:607]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is '3'.
MSI (s) (E0:AC) [18:51:33:607]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is '11972'.
MSI (s) (E0:AC) [18:51:33:607]: Machine policy value 'DisableAutomaticApplicationShutdown' is 0
MSI (s) (E0:AC) [18:51:33:607]: RESTART MANAGER: Disabled by MSIRESTARTMANAGERCONTROL property; Windows Installer will use the built-in FilesInUse functionality.
MSI (s) (E0:AC) [18:51:33:607]: TRANSFORMS property is now:
MSI (s) (E0:AC) [18:51:33:607]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is '200'.
MSI (s) (E0:AC) [18:51:33:608]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming
MSI (s) (E0:AC) [18:51:33:608]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Favorites
MSI (s) (E0:AC) [18:51:33:609]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Network Shortcuts
MSI (s) (E0:AC) [18:51:33:611]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Documents
MSI (s) (E0:AC) [18:51:33:611]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
MSI (s) (E0:AC) [18:51:33:612]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Recent
MSI (s) (E0:AC) [18:51:33:613]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\SendTo
MSI (s) (E0:AC) [18:51:33:613]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Templates
MSI (s) (E0:AC) [18:51:33:613]: SHELL32::SHGetFolderPath returned: C:\ProgramData
MSI (s) (E0:AC) [18:51:33:614]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Local
MSI (s) (E0:AC) [18:51:33:616]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Pictures
MSI (s) (E0:AC) [18:51:33:617]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (E0:AC) [18:51:33:618]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (E0:AC) [18:51:33:619]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
MSI (s) (E0:AC) [18:51:33:620]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Start Menu
MSI (s) (E0:AC) [18:51:33:620]: SHELL32::SHGetFolderPath returned: C:\Users\Public\Desktop
MSI (s) (E0:AC) [18:51:33:622]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
MSI (s) (E0:AC) [18:51:33:622]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
MSI (s) (E0:AC) [18:51:33:624]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
MSI (s) (E0:AC) [18:51:33:624]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Start Menu
MSI (s) (E0:AC) [18:51:33:625]: SHELL32::SHGetFolderPath returned: C:\Users\admin_user\Desktop
MSI (s) (E0:AC) [18:51:33:626]: SHELL32::SHGetFolderPath returned: C:\ProgramData\Microsoft\Windows\Templates
MSI (s) (E0:AC) [18:51:33:626]: SHELL32::SHGetFolderPath returned: C:\Windows\Fonts
MSI (s) (E0:AC) [18:51:33:626]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (E0:AC) [18:51:33:631]: MSI_LUA: Setting MsiRunningElevated property to 1 because the install is already running elevated.
MSI (s) (E0:AC) [18:51:33:631]: PROPERTY CHANGE: Adding MsiRunningElevated property. Its value is '1'.
MSI (s) (E0:AC) [18:51:33:631]: PROPERTY CHANGE: Adding Privileged property. Its value is '1'.
MSI (s) (E0:AC) [18:51:33:631]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (E0:AC) [18:51:33:631]: PROPERTY CHANGE: Adding USERNAME property. Its value is 'user'.
MSI (s) (E0:AC) [18:51:33:631]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (E0:AC) [18:51:33:631]: PROPERTY CHANGE: Adding DATABASE property. Its value is 'C:\Windows\Installer\21e70c.msi'.
MSI (s) (E0:AC) [18:51:33:631]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is 'C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi'.
MSI (s) (E0:AC) [18:51:33:631]: Machine policy value 'MsiDisableEmbeddedUI' is 0
MSI (s) (E0:AC) [18:51:33:631]: EEUI - Disabling MsiEmbeddedUI for service because it's not a quiet/basic install
MSI (s) (E0:AC) [18:51:33:634]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (E0:AC) [18:51:33:634]: Machine policy value 'DisableRollback' is 0
MSI (s) (E0:AC) [18:51:33:634]: User policy value 'DisableRollback' is 0
MSI (s) (E0:AC) [18:51:33:634]: PROPERTY CHANGE: Adding UILevel property. Its value is '2'.
=== Logging started: 14.05.2025 18:51:33 ===
MSI (s) (E0:AC) [18:51:33:635]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (E0:AC) [18:51:33:635]: Note: 1: 2205 2: 3: LaunchCondition
MSI (s) (E0:AC) [18:51:33:635]: Note: 1: 2228 2: 3: LaunchCondition 4: SELECT `Condition` FROM `LaunchCondition`
MSI (s) (E0:AC) [18:51:33:635]: APPCOMPAT: [DetectVersionLaunchCondition] Failed to initialize pRecErr.
MSI (s) (E0:AC) [18:51:33:635]: PROPERTY CHANGE: Adding ACTION property. Its value is 'INSTALL'.
MSI (s) (E0:AC) [18:51:33:635]: Doing action: INSTALL
MSI (s) (E0:AC) [18:51:33:635]: Note: 1: 2205 2: 3: ActionText
Action start 18:51:33: INSTALL.
MSI (s) (E0:AC) [18:51:33:636]: Running ExecuteSequence
MSI (s) (E0:AC) [18:51:33:636]: Doing action: FindRelatedProducts
MSI (s) (E0:AC) [18:51:33:636]: Note: 1: 2205 2: 3: ActionText
Action start 18:51:33: FindRelatedProducts.
MSI (s) (E0:AC) [18:51:33:637]: PROPERTY CHANGE: Adding WIX_UPGRADE_DETECTED property. Its value is '{4612144F-DAED-447A-A7E9-7483C78EF093}'.
MSI (s) (E0:AC) [18:51:33:637]: PROPERTY CHANGE: Adding MIGRATE property. Its value is '{4612144F-DAED-447A-A7E9-7483C78EF093}'.
MSI (s) (E0:AC) [18:51:33:637]: Doing action: CheckSvcRunning
MSI (s) (E0:AC) [18:51:33:637]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:33: FindRelatedProducts. Return value 1.
MSI (s) (E0:48) [18:51:33:638]: Generating random cookie.
MSI (s) (E0:48) [18:51:33:647]: Created Custom Action Server with PID 10256 (0x2810).
MSI (s) (E0:A0) [18:51:33:677]: Running as a service.
MSI (s) (E0:A0) [18:51:33:679]: Hello, I'm your 32bit Impersonated custom action server.
Action start 18:51:33: CheckSvcRunning.
MSI (s) (E0:AC) [18:51:34:363]: Doing action: AppSearch
MSI (s) (E0:AC) [18:51:34:364]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CheckSvcRunning. Return value 0.
Action start 18:51:34: AppSearch.
MSI (s) (E0:AC) [18:51:34:364]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (E0:AC) [18:51:34:364]: PROPERTY CHANGE: Modifying MAJORVERSION property. Its current value is '0'. Its new value: '#10'.
MSI (s) (E0:AC) [18:51:34:364]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (E0:AC) [18:51:34:365]: PROPERTY CHANGE: Modifying BUILDVERSION property. Its current value is '0'. Its new value: '19045'.
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\Software\Wazuh, Inc.\Wazuh Agent 3: 2
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\System\CurrentControlSet\Services\OssecSvc 3: 2
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 2262 2: Signature 3: -2147287038
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\System\CurrentControlSet\Services\WazuhSvc 3: 2
MSI (s) (E0:AC) [18:51:34:365]: Doing action: ValidateProductID
MSI (s) (E0:AC) [18:51:34:365]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: AppSearch. Return value 1.
Action start 18:51:34: ValidateProductID.
MSI (s) (E0:AC) [18:51:34:366]: Doing action: CostInitialize
MSI (s) (E0:AC) [18:51:34:366]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: ValidateProductID. Return value 1.
MSI (s) (E0:AC) [18:51:34:367]: Machine policy value 'MaxPatchCacheSize' is 10
Action start 18:51:34: CostInitialize.
MSI (s) (E0:AC) [18:51:34:368]: PROPERTY CHANGE: Adding ROOTDRIVE property. Its value is 'D:\'.
MSI (s) (E0:AC) [18:51:34:368]: PROPERTY CHANGE: Adding CostingComplete property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: Patch
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: __MsiPatchFileList
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2228 2: 3: PatchPackage 4: SELECT `DiskId`, `PatchId`, `LastSequence` FROM `Media`, `PatchPackage` WHERE `Media`.`DiskId`=`PatchPackage`.`Media_` ORDER BY `DiskId`
MSI (s) (E0:AC) [18:51:34:368]: Note: 1: 2205 2: 3: Patch
MSI (s) (E0:AC) [18:51:34:370]: Doing action: FileCost
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CostInitialize. Return value 1.
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: Class
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: Extension
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: TypeLib
Action start 18:51:34: FileCost.
MSI (s) (E0:AC) [18:51:34:370]: Doing action: WixSetDefaultPerUserFolder
MSI (s) (E0:AC) [18:51:34:370]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: FileCost. Return value 1.
MSI (s) (E0:AC) [18:51:34:371]: PROPERTY CHANGE: Adding WixPerUserFolder property. Its value is 'C:\Users\admin_user\AppData\Local\Apps\ossec-agent'.
Action start 18:51:34: WixSetDefaultPerUserFolder.
MSI (s) (E0:AC) [18:51:34:371]: Doing action: WixSetDefaultPerMachineFolder
MSI (s) (E0:AC) [18:51:34:371]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixSetDefaultPerUserFolder. Return value 1.
MSI (s) (E0:AC) [18:51:34:371]: PROPERTY CHANGE: Adding WixPerMachineFolder property. Its value is 'C:\Program Files (x86)\ossec-agent'.
Action start 18:51:34: WixSetDefaultPerMachineFolder.
MSI (s) (E0:AC) [18:51:34:371]: Skipping action: WixSetPerUserFolder (condition is false)
MSI (s) (E0:AC) [18:51:34:371]: Doing action: WixSetPerMachineFolder
MSI (s) (E0:AC) [18:51:34:371]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixSetDefaultPerMachineFolder. Return value 1.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding APPLICATIONFOLDER property. Its value is 'C:\Program Files (x86)\ossec-agent'.
Action start 18:51:34: WixSetPerMachineFolder.
MSI (s) (E0:AC) [18:51:34:372]: Doing action: CostFinalize
MSI (s) (E0:AC) [18:51:34:372]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixSetPerMachineFolder. Return value 1.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding OutOfDiskSpace property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding OutOfNoRbDiskSpace property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceAvailable property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRequired property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:372]: PROPERTY CHANGE: Adding PrimaryVolumeSpaceRemaining property. Its value is '0'.
MSI (s) (E0:AC) [18:51:34:372]: Note: 1: 2205 2: 3: Patch
MSI (s) (E0:AC) [18:51:34:373]: Note: 1: 2205 2: 3: Condition
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding TARGETDIR property. Its value is 'D:\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding ProgramMenuDir property. Its value is 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Modifying APPLICATIONFOLDER property. Its current value is 'C:\Program Files (x86)\ossec-agent'. Its new value: 'C:\Program Files (x86)\ossec-agent\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding UPGRADE property. Its value is 'C:\Program Files (x86)\ossec-agent\upgrade\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding INCOMING property. Its value is 'C:\Program Files (x86)\ossec-agent\incoming\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding SYSCHECK property. Its value is 'C:\Program Files (x86)\ossec-agent\syscheck\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding RIDS property. Its value is 'C:\Program Files (x86)\ossec-agent\rids\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding WODLES property. Its value is 'C:\Program Files (x86)\ossec-agent\wodles\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding LOGS property. Its value is 'C:\Program Files (x86)\ossec-agent\logs\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding BOOKMARKS property. Its value is 'C:\Program Files (x86)\ossec-agent\bookmarks\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding TMP property. Its value is 'C:\Program Files (x86)\ossec-agent\tmp\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding QUEUE property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding LOGCOLLECTOR property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\logcollector\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding FIM property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\fim\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding FIM_DB property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\fim\db\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding DIFF property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\diff\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding SYSCOLLECTOR property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\syscollector\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding SYSCOLLECTOR_DB property. Its value is 'C:\Program Files (x86)\ossec-agent\queue\syscollector\db\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding RULESET property. Its value is 'C:\Program Files (x86)\ossec-agent\ruleset\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding SECURITY_CONFIGURATION_ASSESSMENT property. Its value is 'C:\Program Files (x86)\ossec-agent\ruleset\sca\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding SHARED property. Its value is 'C:\Program Files (x86)\ossec-agent\shared\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding ACTIVE_RESPONSE property. Its value is 'C:\Program Files (x86)\ossec-agent\active-response\'.
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding BIN property. Its value is 'C:\Program Files (x86)\ossec-agent\active-response\bin\'.
MSI (s) (E0:AC) [18:51:34:373]: Target path resolution complete. Dumping Directory table...
MSI (s) (E0:AC) [18:51:34:373]: Note: target paths subject to change (via custom actions or browsing)
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: TARGETDIR , Object: D:\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: WindowsFolder , Object: C:\Windows\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: ProgramMenuFolder , Object: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: ProgramMenuDir , Object: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: ProgramFilesFolder , Object: C:\Program Files (x86)\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: APPLICATIONFOLDER , Object: C:\Program Files (x86)\ossec-agent\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: UPGRADE , Object: C:\Program Files (x86)\ossec-agent\upgrade\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: INCOMING , Object: C:\Program Files (x86)\ossec-agent\incoming\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: SYSCHECK , Object: C:\Program Files (x86)\ossec-agent\syscheck\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: RIDS , Object: C:\Program Files (x86)\ossec-agent\rids\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: WODLES , Object: C:\Program Files (x86)\ossec-agent\wodles\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: LOGS , Object: C:\Program Files (x86)\ossec-agent\logs\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: BOOKMARKS , Object: C:\Program Files (x86)\ossec-agent\bookmarks\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: TMP , Object: C:\Program Files (x86)\ossec-agent\tmp\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: QUEUE , Object: C:\Program Files (x86)\ossec-agent\queue\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: LOGCOLLECTOR , Object: C:\Program Files (x86)\ossec-agent\queue\logcollector\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: FIM , Object: C:\Program Files (x86)\ossec-agent\queue\fim\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: FIM_DB , Object: C:\Program Files (x86)\ossec-agent\queue\fim\db\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: DIFF , Object: C:\Program Files (x86)\ossec-agent\queue\diff\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: SYSCOLLECTOR , Object: C:\Program Files (x86)\ossec-agent\queue\syscollector\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: SYSCOLLECTOR_DB , Object: C:\Program Files (x86)\ossec-agent\queue\syscollector\db\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: RULESET , Object: C:\Program Files (x86)\ossec-agent\ruleset\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: SECURITY_CONFIGURATION_ASSESSMENT , Object: C:\Program Files (x86)\ossec-agent\ruleset\sca\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: SHARED , Object: C:\Program Files (x86)\ossec-agent\shared\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: ACTIVE_RESPONSE , Object: C:\Program Files (x86)\ossec-agent\active-response\
MSI (s) (E0:AC) [18:51:34:373]: Dir (target): Key: BIN , Object: C:\Program Files (x86)\ossec-agent\active-response\bin\
MSI (s) (E0:AC) [18:51:34:373]: PROPERTY CHANGE: Adding INSTALLLEVEL property. Its value is '1'.
MSI (s) (E0:AC) [18:51:34:373]: Note: 1: 2205 2: 3: MsiAssembly
MSI (s) (E0:AC) [18:51:34:373]: Note: 1: 2228 2: 3: MsiAssembly 4: SELECT `MsiAssembly`.`Attributes`, `MsiAssembly`.`File_Application`, `MsiAssembly`.`File_Manifest`, `Component`.`KeyPath` FROM `MsiAssembly`, `Component` WHERE `MsiAssembly`.`Component_` = `Component`.`Component` AND `MsiAssembly`.`Component_` = ?
Action start 18:51:34: CostFinalize.
MSI (s) (E0:AC) [18:51:34:375]: Doing action: MigrateFeatureStates
MSI (s) (E0:AC) [18:51:34:375]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CostFinalize. Return value 1.
MSI (s) (E0:AC) [18:51:34:375]: Migrating feature settings from product(s) '{4612144F-DAED-447A-A7E9-7483C78EF093}'
MSI (s) (E0:AC) [18:51:34:375]: MigrateFeatureStates: based on existing product, setting feature 'MainFeature' to 'Absent' state.
Action start 18:51:34: MigrateFeatureStates.
MSI (s) (E0:AC) [18:51:34:376]: Doing action: InstallValidate
MSI (s) (E0:AC) [18:51:34:376]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: MigrateFeatureStates. Return value 1.
MSI (s) (E0:AC) [18:51:34:376]: Feature: MainFeature; Installed: Absent; Request: Absent; Action: Absent
MSI (s) (E0:AC) [18:51:34:376]: Component: REGISTRY_INSTALL_DIR; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: AGENT_AUTH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LIBWAZUHEXT_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LIBWAZUHSHARED_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: DBSYNC_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: RSYNC_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SYSINFO_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SYSCOLLECTOR_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: FIMDB_DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LOCAL_INTERNAL_OPTIONS.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: OSSEC.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: INTERNAL_OPTIONS.CONF; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LICENSE.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LIBWINPTHREAD_1.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LIBGCC_S_DW2_1.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: LIBSTDCPP_6.DLL; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: MANAGE_AGENTS.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WAZUH_AGENT_EVENTCHANNEL.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WAZUH_AGENT.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: VISTA_SEC.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WIN32UI.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: REMOVE_OLD_NSIS; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: HELP_WIN.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: VERSION.JSON; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WPK_ROOT.PEM; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WXP_CONF_LOCALFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WXP_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WXP_CONF_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2003_CONF_LOCALFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2003_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2003_CONF_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WVISTA_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2008_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W7_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2008R2_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W8_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2012_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W8.1_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2012R2_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W10_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2016_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: W2019_CONF_PROFILE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: RESTART_WAZUH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: ROUTE_NULL.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: NETSH.EXE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: REMOVE_OLD_AR; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: ACTIVE_RESPONSES.LOG; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: ROOTKIT_FILES.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: ROOTKIT_TROJANS.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WIN_APPLICATIONS_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WIN_AUDIT_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: WIN_MALWARE_RCL.TXT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: REMOVE_OLD_POLICIES; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN10; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN11; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2012R2; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2012NONR2; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2016; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2019; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2022; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SCA_WIN2025; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: SYSCOLLECTOR_NORM_CONFIG; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: StartMenuShortcuts; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:376]: Component: CMP_ACTIVE_RESPONSE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_TMP; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_QUEUE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_DIFF; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_FIM; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_FIM_DB; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_SYSCOLLECTOR; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_SYSCOLLECTOR_DB; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_LOGCOLLECTOR; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_RULESET; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_SECURITY_CONFIGURATION_ASSESSMENT; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_BOOKMARKS; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_LOGS; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_WODLES; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_RIDS; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_SYSCHECK; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_INCOMING; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_UPGRADE; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: CMP_SHARED; Installed: Absent; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: __REGISTRY_INSTALL_DIR65; Installed: Null; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Component: __StartMenuShortcuts65; Installed: Null; Request: Null; Action: Null
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: BindImage
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: ProgId
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: Extension
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: Font
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: Class
MSI (s) (E0:AC) [18:51:34:377]: Note: 1: 2205 2: 3: TypeLib
Action start 18:51:34: InstallValidate.
MSI (s) (E0:AC) [18:51:34:383]: PROPERTY CHANGE: Modifying CostingComplete property. Its current value is '0'. Its new value: '1'.
MSI (s) (E0:AC) [18:51:34:383]: Note: 1: 2205 2: 3: BindImage
MSI (s) (E0:AC) [18:51:34:383]: Note: 1: 2205 2: 3: ProgId
MSI (s) (E0:AC) [18:51:34:383]: Note: 1: 2205 2: 3: PublishComponent
MSI (s) (E0:AC) [18:51:34:383]: Note: 1: 2205 2: 3: SelfReg
MSI (s) (E0:AC) [18:51:34:384]: Note: 1: 2205 2: 3: Extension
MSI (s) (E0:AC) [18:51:34:384]: Note: 1: 2205 2: 3: Font
MSI (s) (E0:AC) [18:51:34:384]: Note: 1: 2205 2: 3: Class
MSI (s) (E0:AC) [18:51:34:384]: Note: 1: 2205 2: 3: TypeLib
MSI (s) (E0:AC) [18:51:34:384]: Note: 1: 2727 2:
MSI (s) (E0:AC) [18:51:34:385]: Note: 1: 2727 2:
MSI (s) (E0:AC) [18:51:34:385]: PROPERTY CHANGE: Adding REMOVE property. Its value is 'ALL'.
MSI (s) (E0:AC) [18:51:34:385]: Doing action: InstallInitialize
MSI (s) (E0:AC) [18:51:34:385]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: InstallValidate. Return value 1.
MSI (s) (E0:AC) [18:51:34:385]: Machine policy value 'AlwaysInstallElevated' is 0
MSI (s) (E0:AC) [18:51:34:385]: User policy value 'AlwaysInstallElevated' is 0
MSI (s) (E0:AC) [18:51:34:385]: BeginTransaction: Locking Server
MSI (s) (E0:AC) [18:51:34:386]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (E0:AC) [18:51:34:386]: SRSetRestorePoint skipped for this transaction.
MSI (s) (E0:AC) [18:51:34:386]: Note: 1: 2203 2: C:\Windows\Installer\inprogressinstallinfo.ipi 3: -2147287038
MSI (s) (E0:AC) [18:51:34:386]: Server not locked: locking for product {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
Action start 18:51:34: InstallInitialize.
MSI (s) (E0:AC) [18:51:34:397]: Doing action: RemoveExistingProducts
MSI (s) (E0:AC) [18:51:34:397]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: InstallInitialize. Return value 1.
MSI (s) (E0:AC) [18:51:34:398]: Skipping RemoveExistingProducts action: current configuration is maintenance mode or an uninstall
Action start 18:51:34: RemoveExistingProducts.
MSI (s) (E0:AC) [18:51:34:398]: Doing action: SetCustomActionDataForSetWazuhPermissions
MSI (s) (E0:AC) [18:51:34:398]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RemoveExistingProducts. Return value 0.
MSI (s) (E0:AC) [18:51:34:398]: PROPERTY CHANGE: Adding SetWazuhPermissions property. Its value is '"C:\Program Files (x86)\ossec-agent\"'.
Action start 18:51:34: SetCustomActionDataForSetWazuhPermissions.
MSI (s) (E0:AC) [18:51:34:398]: Doing action: SetWazuhPermissions
MSI (s) (E0:AC) [18:51:34:398]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: SetCustomActionDataForSetWazuhPermissions. Return value 1.
MSI (s) (E0:AC) [18:51:34:399]: Note: 1: 2205 2: 3: MsiPatchCertificate
MSI (s) (E0:AC) [18:51:34:399]: LUA patching is disabled: missing MsiPatchCertificate table
MSI (s) (E0:AC) [18:51:34:399]: Resolving source.
MSI (s) (E0:AC) [18:51:34:399]: Resolving source to launched-from source.
MSI (s) (E0:AC) [18:51:34:399]: Setting launched-from source as last-used.
MSI (s) (E0:AC) [18:51:34:399]: PROPERTY CHANGE: Adding SourceDir property. Its value is 'C:\Program Files (x86)\ossec-agent\'.
MSI (s) (E0:AC) [18:51:34:399]: PROPERTY CHANGE: Adding SOURCEDIR property. Its value is 'C:\Program Files (x86)\ossec-agent\'.
MSI (s) (E0:AC) [18:51:34:399]: PROPERTY CHANGE: Adding SourcedirProduct property. Its value is '{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}'.
MSI (s) (E0:AC) [18:51:34:399]: SOURCEDIR ==> C:\Program Files (x86)\ossec-agent\
MSI (s) (E0:AC) [18:51:34:399]: SOURCEDIR product ==> {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (E0:AC) [18:51:34:399]: Determining source type
MSI (s) (E0:AC) [18:51:34:399]: Source type from package 'wazuh-agent-4.12.0-1.msi': 2
MSI (s) (E0:AC) [18:51:34:400]: SECREPAIR: Hash Database: C:\Windows\Installer\SourceHash{80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (E0:AC) [18:51:34:400]: SECREPAIR: SourceHash database file already exists. Deleting it.
MSI (s) (E0:AC) [18:51:34:401]: Note: 1: 2262 2: SourceHash 3: -2147287038
MSI (s) (E0:AC) [18:51:34:403]: SECREPAIR: New Hash Database creation complete.
MSI (s) (E0:AC) [18:51:34:432]: Source path resolution complete. Dumping Directory table...
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: TARGETDIR , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: , ShortSubPath:
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: WindowsFolder , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: , ShortSubPath:
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: ProgramMenuFolder , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: , ShortSubPath:
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: ProgramMenuDir , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: OSSEC\ , ShortSubPath:
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: ProgramFilesFolder , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ , ShortSubPath:
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: APPLICATIONFOLDER , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\ , ShortSubPath: PFiles\fjokbowa\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: UPGRADE , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\upgrade\ , ShortSubPath: PFiles\fjokbowa\upgrade\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: INCOMING , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\incoming\ , ShortSubPath: PFiles\fjokbowa\incoming\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: SYSCHECK , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\syscheck\ , ShortSubPath: PFiles\fjokbowa\syscheck\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: RIDS , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\rids\ , ShortSubPath: PFiles\fjokbowa\rids\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: WODLES , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\wodles\ , ShortSubPath: PFiles\fjokbowa\wodles\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: LOGS , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\logs\ , ShortSubPath: PFiles\fjokbowa\logs\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: BOOKMARKS , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\bookmarks\ , ShortSubPath: PFiles\fjokbowa\ecn_axgq\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: TMP , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\tmp\ , ShortSubPath: PFiles\fjokbowa\tmp\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: QUEUE , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\ , ShortSubPath: PFiles\fjokbowa\queue\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: LOGCOLLECTOR , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\logcollector\ , ShortSubPath: PFiles\fjokbowa\queue\c-7jkeo6\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: FIM , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\fim\ , ShortSubPath: PFiles\fjokbowa\queue\fim\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: FIM_DB , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\fim\db\ , ShortSubPath: PFiles\fjokbowa\queue\fim\db\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: DIFF , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\diff\ , ShortSubPath: PFiles\fjokbowa\queue\diff\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: SYSCOLLECTOR , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\syscollector\ , ShortSubPath: PFiles\fjokbowa\queue\bnp5_md3\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: SYSCOLLECTOR_DB , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\queue\syscollector\db\ , ShortSubPath: PFiles\fjokbowa\queue\bnp5_md3\db\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: RULESET , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\ruleset\ , ShortSubPath: PFiles\fjokbowa\ruleset\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: SECURITY_CONFIGURATION_ASSESSMENT , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\ruleset\sca\ , ShortSubPath: PFiles\fjokbowa\ruleset\sca\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: SHARED , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\shared\ , ShortSubPath: PFiles\fjokbowa\shared\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: ACTIVE_RESPONSE , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\active-response\ , ShortSubPath: PFiles\fjokbowa\9pxtresz\
MSI (s) (E0:AC) [18:51:34:432]: Dir (source): Key: BIN , Object: C:\Program Files (x86)\ossec-agent\ , LongSubPath: PFiles\ossec-agent\active-response\bin\ , ShortSubPath: PFiles\fjokbowa\9pxtresz\bin\
MSI (s) (E0:AC) [18:51:34:432]: Note: 1: 2205 2: 3: ActionText
MSI (s) (E0:AC) [18:51:34:434]: Note: 1: 2205 2: 3: ActionText
MSI (s) (E0:AC) [18:51:34:435]: Note: 1: 2205 2: 3: ActionText
Action start 18:51:34: SetWazuhPermissions.
MSI (s) (E0:AC) [18:51:34:437]: Skipping action: SetAgentGroup (condition is false)
MSI (s) (E0:AC) [18:51:34:437]: Skipping action: SetAgentName (condition is false)
MSI (s) (E0:AC) [18:51:34:437]: Skipping action: SetOSVersion0 (condition is false)
MSI (s) (E0:AC) [18:51:34:437]: Skipping action: SetOSVersion1 (condition is false)
MSI (s) (E0:AC) [18:51:34:437]: Doing action: SetOSVersion10
MSI (s) (E0:AC) [18:51:34:437]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: SetWazuhPermissions. Return value 1.
MSI (s) (E0:AC) [18:51:34:437]: PROPERTY CHANGE: Adding OS_VERSION property. Its value is '10'.
Action start 18:51:34: SetOSVersion10.
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion11 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion12 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion2 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion3 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion4 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion5 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion6 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion7 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion8 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetOSVersion9 (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationCA (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationCertificate (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationKet (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationPassword (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationPort (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetRegistrationServer (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetWazuhKeepAlive (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetWazuhManager (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetWazuhManagerPort (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetWazuhManagerProtocol (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetWazuhTimeReconnect (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: SetCustomActionDataValue (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: CustomAction_InstallerScripts (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: StopOssecService (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Skipping action: DeleteOssecService (condition is false)
MSI (s) (E0:AC) [18:51:34:438]: Doing action: ProcessComponents
MSI (s) (E0:AC) [18:51:34:438]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: SetOSVersion10. Return value 1.
Action start 18:51:34: ProcessComponents.
MSI (s) (E0:AC) [18:51:34:439]: Doing action: UnpublishFeatures
MSI (s) (E0:AC) [18:51:34:439]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: ProcessComponents. Return value 1.
Action start 18:51:34: UnpublishFeatures.
MSI (s) (E0:AC) [18:51:34:440]: Doing action: SchedSecureObjectsRollback
MSI (s) (E0:AC) [18:51:34:440]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: UnpublishFeatures. Return value 1.
MSI (s) (E0:54) [18:51:34:441]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI677E.tmp, Entrypoint: SchedSecureObjectsRollback
Action start 18:51:34: SchedSecureObjectsRollback.
MSI (s) (E0!44) [18:51:34:446]: Note: 1: 2753 2: OSSEC.CONF
MSI (s) (E0!44) [18:51:34:446]: Note: 1: 2753 2: OSSEC.CONF
SchedSecureObjectsRollback: Entering SchedSecureObjectsRollback in C:\Windows\Installer\MSI677E.tmp, version 3.11.4516.0
SchedSecureObjectsRollback: Error 0x8007007b: Unable to schedule rollback for object:
SchedSecureObjectsRollback: Failed to store ACL rollback information with error 0x8007007b - continuing
MSI (s) (E0:AC) [18:51:34:449]: Doing action: StopServices
MSI (s) (E0:AC) [18:51:34:449]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: SchedSecureObjectsRollback. Return value 1.
Action start 18:51:34: StopServices.
MSI (s) (E0:AC) [18:51:34:450]: Doing action: DeleteServices
MSI (s) (E0:AC) [18:51:34:451]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: StopServices. Return value 1.
Action start 18:51:34: DeleteServices.
MSI (s) (E0:AC) [18:51:34:452]: Doing action: RemoveRegistryValues
MSI (s) (E0:AC) [18:51:34:452]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: DeleteServices. Return value 1.
Action start 18:51:34: RemoveRegistryValues.
MSI (s) (E0:AC) [18:51:34:452]: Doing action: RemoveShortcuts
MSI (s) (E0:AC) [18:51:34:452]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RemoveRegistryValues. Return value 1.
Action start 18:51:34: RemoveShortcuts.
MSI (s) (E0:AC) [18:51:34:454]: Doing action: RemoveFiles
MSI (s) (E0:AC) [18:51:34:454]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RemoveShortcuts. Return value 1.
Action start 18:51:34: RemoveFiles.
MSI (s) (E0:AC) [18:51:34:455]: Doing action: WixSchedInternetShortcuts
MSI (s) (E0:AC) [18:51:34:455]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RemoveFiles. Return value 1.
MSI (s) (E0:48) [18:51:34:457]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI678E.tmp, Entrypoint: WixSchedInternetShortcuts
Action start 18:51:34: WixSchedInternetShortcuts.
WixSchedInternetShortcuts: Entering WixSchedInternetShortcuts in C:\Windows\Installer\MSI678E.tmp, version 3.11.4516.0
WixSchedInternetShortcuts: Skipping shortcut for null-action component 'StartMenuShortcuts'
MSI (s) (E0:AC) [18:51:34:473]: Doing action: RemoveFolders
MSI (s) (E0:AC) [18:51:34:473]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixSchedInternetShortcuts. Return value 1.
Action start 18:51:34: RemoveFolders.
MSI (s) (E0:AC) [18:51:34:474]: Doing action: CreateFolders
MSI (s) (E0:AC) [18:51:34:474]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RemoveFolders. Return value 1.
Action start 18:51:34: CreateFolders.
MSI (s) (E0:AC) [18:51:34:474]: Doing action: InstallFiles
MSI (s) (E0:AC) [18:51:34:474]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CreateFolders. Return value 1.
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2205 2: 3: Patch
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2228 2: 3: Patch 4: SELECT `Patch`.`File_`, `Patch`.`Header`, `Patch`.`Attributes`, `Patch`.`Sequence`, `Patch`.`StreamRef_` FROM `Patch` WHERE `Patch`.`File_` = ? AND `Patch`.`#_MsiActive`=? ORDER BY `Patch`.`Sequence`
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2205 2: 3: MsiSFCBypass
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2228 2: 3: MsiSFCBypass 4: SELECT `File_` FROM `MsiSFCBypass` WHERE `File_` = ?
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2205 2: 3: MsiPatchHeaders
MSI (s) (E0:AC) [18:51:34:477]: Note: 1: 2228 2: 3: MsiPatchHeaders 4: SELECT `Header` FROM `MsiPatchHeaders` WHERE `StreamRef` = ?
Action start 18:51:34: InstallFiles.
MSI (s) (E0:AC) [18:51:34:479]: Doing action: CreateShortcuts
MSI (s) (E0:AC) [18:51:34:479]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: InstallFiles. Return value 1.
MSI (s) (E0:AC) [18:51:34:480]: Note: 1: 2205 2: 3: MsiShortcutProperty
MSI (s) (E0:AC) [18:51:34:480]: Note: 1: 2205 2: 3: MsiShortcutProperty
Action start 18:51:34: CreateShortcuts.
MSI (s) (E0:AC) [18:51:34:480]: Doing action: WixRollbackInternetShortcuts
MSI (s) (E0:AC) [18:51:34:480]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CreateShortcuts. Return value 1.
Action start 18:51:34: WixRollbackInternetShortcuts.
MSI (s) (E0:AC) [18:51:34:482]: Doing action: WixCreateInternetShortcuts
MSI (s) (E0:AC) [18:51:34:482]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixRollbackInternetShortcuts. Return value 1.
Action start 18:51:34: WixCreateInternetShortcuts.
MSI (s) (E0:AC) [18:51:34:485]: Doing action: WriteRegistryValues
MSI (s) (E0:AC) [18:51:34:485]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WixCreateInternetShortcuts. Return value 1.
Action start 18:51:34: WriteRegistryValues.
MSI (s) (E0:AC) [18:51:34:485]: Doing action: InstallServices
MSI (s) (E0:AC) [18:51:34:485]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: WriteRegistryValues. Return value 1.
Action start 18:51:34: InstallServices.
MSI (s) (E0:AC) [18:51:34:486]: Skipping action: SchedSecureObjects (condition is false)
MSI (s) (E0:AC) [18:51:34:486]: Skipping action: StartWazuhSvc (condition is false)
MSI (s) (E0:AC) [18:51:34:486]: Doing action: StartServices
MSI (s) (E0:AC) [18:51:34:486]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: InstallServices. Return value 1.
Action start 18:51:34: StartServices.
MSI (s) (E0:AC) [18:51:34:487]: Doing action: RegisterUser
MSI (s) (E0:AC) [18:51:34:487]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: StartServices. Return value 1.
Action start 18:51:34: RegisterUser.
MSI (s) (E0:AC) [18:51:34:488]: Doing action: RegisterProduct
MSI (s) (E0:AC) [18:51:34:488]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RegisterUser. Return value 1.
Action start 18:51:34: RegisterProduct.
MSI (s) (E0:AC) [18:51:34:488]: Doing action: PublishFeatures
MSI (s) (E0:AC) [18:51:34:488]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: RegisterProduct. Return value 1.
Action start 18:51:34: PublishFeatures.
MSI (s) (E0:AC) [18:51:34:489]: Doing action: PublishProduct
MSI (s) (E0:AC) [18:51:34:489]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: PublishFeatures. Return value 1.
Action start 18:51:34: PublishProduct.
MSI (s) (E0:AC) [18:51:34:490]: Doing action: CloseGUI
MSI (s) (E0:AC) [18:51:34:490]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: PublishProduct. Return value 1.
Action start 18:51:34: CloseGUI.
MSI (s) (E0:AC) [18:51:34:491]: Doing action: CreateDumpRegistryKey
MSI (s) (E0:AC) [18:51:34:491]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CloseGUI. Return value 1.
Action start 18:51:34: CreateDumpRegistryKey.
MSI (s) (E0:AC) [18:51:34:492]: Doing action: SetRemoveAllDataValue
MSI (s) (E0:AC) [18:51:34:492]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CreateDumpRegistryKey. Return value 1.
MSI (s) (E0:AC) [18:51:34:493]: PROPERTY CHANGE: Adding CustomAction_RemoveAllScript property. Its value is '"C:\Program Files (x86)\ossec-agent\"'.
Action start 18:51:34: SetRemoveAllDataValue.
MSI (s) (E0:AC) [18:51:34:493]: Doing action: CustomAction_RemoveAllScript
MSI (s) (E0:AC) [18:51:34:493]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: SetRemoveAllDataValue. Return value 1.
Action start 18:51:34: CustomAction_RemoveAllScript.
MSI (s) (E0:AC) [18:51:34:494]: Doing action: InstallFinalize
MSI (s) (E0:AC) [18:51:34:494]: Note: 1: 2205 2: 3: ActionText
Action ended 18:51:34: CustomAction_RemoveAllScript. Return value 1.
MSI (s) (E0:AC) [18:51:34:494]: Running Script: C:\Windows\Installer\MSI677D.tmp
MSI (s) (E0:AC) [18:51:34:494]: PROPERTY CHANGE: Adding UpdateStarted property. Its value is '1'.
MSI (s) (E0:AC) [18:51:34:495]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (E0:AC) [18:51:34:496]: Machine policy value 'DisableRollback' is 0
MSI (s) (E0:AC) [18:51:34:496]: Note: 1: 2318 2:
MSI (s) (E0:AC) [18:51:34:497]: Note: 1: 2318 2:
MSI (s) (E0:AC) [18:51:34:498]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (E0:AC) [18:51:34:498]: Executing op: Header(Signature=1397708873,Version=500,Timestamp=1521391218,LangId=1033,Platform=0,ScriptType=1,ScriptMajorVersion=21,ScriptMinorVersion=4,ScriptAttributes=1)
Action start 18:51:34: InstallFinalize.
MSI (s) (E0:AC) [18:51:34:498]: Executing op: ProductInfo(ProductKey={80B7D7ED-A637-46F3-96FC-2F9EA44F9886},ProductName=Wazuh Agent,PackageName=wazuh-agent-4.12.0-1.msi,Language=1033,Version=67895296,Assignment=1,ObsoleteArg=0,ProductIcon=icon.ico,,PackageCode={8D57269C-2008-4289-AD64-3C477FEA0843},,,InstanceType=0,LUASetting=0,RemoteURTInstalls=0,ProductDeploymentFlags=3)
MSI (s) (E0:AC) [18:51:34:498]: Executing op: DialogInfo(Type=0,Argument=1033)
MSI (s) (E0:AC) [18:51:34:499]: Executing op: DialogInfo(Type=1,Argument=Wazuh Agent)
MSI (s) (E0:AC) [18:51:34:499]: Executing op: RollbackInfo(,RollbackAction=Rollback,RollbackDescription=Rolling back action:,RollbackTemplate=[1],CleanupAction=RollbackCleanup,CleanupDescription=Removing backup files,CleanupTemplate=File: [1])
MSI (s) (E0:AC) [18:51:34:499]: Executing op: SetBaseline(Baseline=0,)
MSI (s) (E0:AC) [18:51:34:499]: Executing op: SetBaseline(Baseline=1,)
MSI (s) (E0:AC) [18:51:34:499]: Executing op: ActionStart(Name=SetWazuhPermissions,,)
MSI (s) (E0:AC) [18:51:34:499]: Executing op: CustomActionSchedule(Action=SetWazuhPermissions,ActionType=3590,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripting
MSI (s) (E0:AC) [18:51:34:499]: Executing op: ActionStart(Name=WixRollbackInternetShortcuts,,)
MSI (s) (E0:AC) [18:51:34:500]: Executing op: CustomActionSchedule(Action=WixRollbackInternetShortcuts,ActionType=3329,Source=BinaryData,Target=WixRollbackInternetShortcuts,)
MSI (s) (E0:AC) [18:51:34:500]: Executing op: ActionStart(Name=WixCreateInternetShortcuts,,)
MSI (s) (E0:AC) [18:51:34:501]: Executing op: CustomActionSchedule(Action=WixCreateInternetShortcuts,ActionType=3073,Source=BinaryData,Target=WixCreateInternetShortcuts,)
MSI (s) (E0:60) [18:51:34:502]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI67BE.tmp, Entrypoint: WixCreateInternetShortcuts
MSI (s) (E0:48) [18:51:34:502]: Generating random cookie.
MSI (s) (E0:48) [18:51:34:511]: Created Custom Action Server with PID 11508 (0x2CF4).
MSI (s) (E0:A0) [18:51:34:553]: Running as a service.
MSI (s) (E0:A0) [18:51:34:555]: Hello, I'm your 32bit Elevated Non-remapped custom action server.
MSI (s) (E0:AC) [18:51:34:565]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)
WixCreateInternetShortcuts: Entering WixCreateInternetShortcuts in C:\Windows\Installer\MSI67BE.tmp, version 3.11.4516.0
MSI (s) (E0:AC) [18:51:34:565]: Executing op: CleanupConfigData()
MSI (s) (E0:AC) [18:51:34:566]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
MSI (s) (E0:AC) [18:51:34:566]: Note: 1: 1402 2: UNKNOWN\Products\DE7D7B08736A3F6469CFF2E94AF48968\Patches 3: 2
MSI (s) (E0:AC) [18:51:34:566]: Executing op: ActionStart(Name=CloseGUI,,)
MSI (s) (E0:AC) [18:51:34:567]: Executing op: CustomActionSchedule(Action=CloseGUI,ActionType=3078,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripting.Dictionary
MSI (s) (E0:AC) [18:51:34:765]: Executing op: ActionStart(Name=CreateDumpRegistryKey,,)
MSI (s) (E0:AC) [18:51:34:765]: Executing op: CustomActionSchedule(Action=CreateDumpRegistryKey,ActionType=1030,Source=
' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------'
On Error Resume Next
private function get_unique_array_values(array)
Dim dicTemp : Set dicTemp = CreateObject("Scripti
MSI (s) (E0:AC) [18:51:34:821]: Executing op: ActionStart(Name=CustomAction_RemoveAllScript,,)
MSI (s) (E0:AC) [18:51:34:822]: Executing op: CustomActionSchedule(Action=CustomAction_RemoveAllScript,ActionType=3590,Source=' Script for configuration Windows agent.
' Copyright (C) 2015, Wazuh Inc. <sup...@wazuh.com>
'
' This program is free software; you can redistribute it and/or modify
' it under the terms of the GNU General Public License as published by
' the Free Software Foundation; either version 3 of the License, or
' (at your option) any later version.
'
' This program is distributed in the hope that it will be useful,
' but WITHOUT ANY WARRANTY; without even the implied warranty of
' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
' GNU General Public License for more details.
'
' You should have received a copy of the GNU General Public License
' along with this program; if not, write to the Free Software Foundation,
' Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
'
' ------------------------------------------------
' This function is called only when uninstalling the product.
' Remove everything, but a few specified items.
'
publi
MSI (s) (E0:AC) [18:51:34:822]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=0)
MSI (s) (E0:AC) [18:51:34:835]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (E0:AC) [18:51:34:835]: User policy value 'DisableRollback' is 0
MSI (s) (E0:AC) [18:51:34:835]: Machine policy value 'DisableRollback' is 0
MSI (s) (E0:AC) [18:51:34:839]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (E0:AC) [18:51:35:610]: Note: 1: 2318 2:
MSI (s) (E0:AC) [18:51:35:611]: Note: 1: 2318 2:
MSI (s) (E0:AC) [18:51:35:612]: No System Restore sequence number for this installation.
MSI (s) (E0:AC) [18:51:35:612]: Unlocking Server
MSI (s) (E0:AC) [18:51:35:613]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
Action ended 18:51:35: InstallFinalize. Return value 1.
Action ended 18:51:35: INSTALL. Return value 1.
Property(S): UpgradeCode = {F495AC57-7BDE-4C4B-92D8-DBE40A9AA5A0}
Property(S): MAJORVERSION = #10
Property(S): BUILDVERSION = 19045
Property(S): APPLICATIONFOLDER = C:\Program Files (x86)\ossec-agent\
Property(S): GENERATE_DUMP = 1
Property(S): BIN = C:\Program Files (x86)\ossec-agent\active-response\bin\
Property(S): ACTIVE_RESPONSE = C:\Program Files (x86)\ossec-agent\active-response\
Property(S): SHARED = C:\Program Files (x86)\ossec-agent\shared\
Property(S): SECURITY_CONFIGURATION_ASSESSMENT = C:\Program Files (x86)\ossec-agent\ruleset\sca\
Property(S): SYSCOLLECTOR = C:\Program Files (x86)\ossec-agent\queue\syscollector\
Property(S): ProgramMenuDir = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OSSEC\
Property(S): TMP = C:\Program Files (x86)\ossec-agent\tmp\
Property(S): QUEUE = C:\Program Files (x86)\ossec-agent\queue\
Property(S): DIFF = C:\Program Files (x86)\ossec-agent\queue\diff\
Property(S): FIM = C:\Program Files (x86)\ossec-agent\queue\fim\
Property(S): FIM_DB = C:\Program Files (x86)\ossec-agent\queue\fim\db\
Property(S): SYSCOLLECTOR_DB = C:\Program Files (x86)\ossec-agent\queue\syscollector\db\
Property(S): LOGCOLLECTOR = C:\Program Files (x86)\ossec-agent\queue\logcollector\
Property(S): RULESET = C:\Program Files (x86)\ossec-agent\ruleset\
Property(S): BOOKMARKS = C:\Program Files (x86)\ossec-agent\bookmarks\
Property(S): LOGS = C:\Program Files (x86)\ossec-agent\logs\
Property(S): WODLES = C:\Program Files (x86)\ossec-agent\wodles\
Property(S): RIDS = C:\Program Files (x86)\ossec-agent\rids\
Property(S): SYSCHECK = C:\Program Files (x86)\ossec-agent\syscheck\
Property(S): INCOMING = C:\Program Files (x86)\ossec-agent\incoming\
Property(S): UPGRADE = C:\Program Files (x86)\ossec-agent\upgrade\
Property(S): WixUIRMOption = UseRM
Property(S): WixAppFolder = WixPerMachineFolder
Property(S): WIXUI_INSTALLDIR = APPLICATIONFOLDER
Property(S): ALLUSERS = 1
Property(S): Privileged = 1
Property(S): ARPNOMODIFY = yes
Property(S): ARPNOREPAIR = yes
Property(S): WixPerUserFolder = C:\Users\admin_user\AppData\Local\Apps\ossec-agent
Property(S): OS_VERSION = 10
Property(S): WAZUH_MANAGER = 192.168.100.18
Property(S): CustomAction_RemoveAllScript = "C:\Program Files (x86)\ossec-agent\"
Property(S): SetWazuhPermissions = "C:\Program Files (x86)\ossec-agent\"
Property(S): WixPerMachineFolder = C:\Program Files (x86)\ossec-agent
Property(S): ProgramFilesFolder = C:\Program Files (x86)\
Property(S): TARGETDIR = D:\
Property(S): ProgramMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
Property(S): SourceDir = C:\Program Files (x86)\ossec-agent\
Property(S): VersionNT = 603
Property(S): MSIRESTARTMANAGERCONTROL = Disable
Property(S): MsiLogging = v
Property(S): ARPPRODUCTICON = icon.ico
Property(S): WIXUI_EXITDIALOGOPTIONALCHECKBOXTEXT = Run Agent configuration interface
Property(S): DEFAULT_GENERATE_DUMP = 1
Property(S): ApplicationFolderName = ossec-agent
Property(S): WixShellExecTarget = [APPLICATIONFOLDER]win32ui.exe
Property(S): Manufacturer = Wazuh, Inc.
Property(S): ProductCode = {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
Property(S): ProductLanguage = 1033
Property(S): ProductName = Wazuh Agent
Property(S): ProductVersion = 4.12.0
Property(S): DefaultUIFont = WixUI_Font_Normal
Property(S): WixUI_Mode = Advanced
Property(S): ErrorDialog = ErrorDlg
Property(S): SecureCustomProperties = ADDRESS;AGENT_NAME;AUTHD_PORT;AUTHD_SERVER;CERTIFICATE;GROUP;KEY;NOTIFY_TIME;OS_VERSION;PASSWORD;PEM;PROTOCOL;SERVER_PORT;TIME_RECONNECT;WAZUH_AGENT_GROUP;WAZUH_AGENT_NAME;WAZUH_KEEP_ALIVE_INTERVAL;WAZUH_MANAGER;WAZUH_MANAGER_PORT;WAZUH_PROTOCOL;WAZUH_REGISTRATION_CA;WAZUH_REGISTRATION_CERTIFICATE;WAZUH_REGISTRATION_KEY;WAZUH_REGISTRATION_PASSWORD;WAZUH_REGISTRATION_PORT;WAZUH_REGISTRATION_SERVER;WAZUH_TIME_RECONNECT;WIX_UPGRADE_DETECTED
Property(S): MsiHiddenProperties = ExecSecureObjects;ExecSecureObjectsRollback
Property(S): WIX_UPGRADE_DETECTED = {4612144F-DAED-447A-A7E9-7483C78EF093}
Property(S): MsiLogFileLocation = C:\Program Files (x86)\ossec-agent\install.log
Property(S): PackageCode = {8D57269C-2008-4289-AD64-3C477FEA0843}
Property(S): ProductState = -1
Property(S): PackagecodeChanging = 1
Property(S): CURRENTDIRECTORY = C:\Program Files (x86)\ossec-agent
Property(S): CLIENTUILEVEL = 3
Property(S): CLIENTPROCESSID = 11972
Property(S): VersionDatabase = 200
Property(S): VersionMsi = 5.00
Property(S): VersionNT64 = 603
Property(S): WindowsBuild = 9600
Property(S): ServicePackLevel = 0
Property(S): ServicePackLevelMinor = 0
Property(S): MsiNTProductType = 1
Property(S): WindowsFolder = C:\Windows\
Property(S): WindowsVolume = C:\
Property(S): System64Folder = C:\Windows\system32\
Property(S): SystemFolder = C:\Windows\SysWOW64\
Property(S): RemoteAdminTS = 1
Property(S): TempFolder = C:\Users\admin_user1\AppData\Local\Temp\
Property(S): CommonFilesFolder = C:\Program Files (x86)\Common Files\
Property(S): ProgramFiles64Folder = C:\Program Files\
Property(S): CommonFiles64Folder = C:\Program Files\Common Files\
Property(S): AppDataFolder = C:\Users\admin_user\AppData\Roaming\
Property(S): FavoritesFolder = C:\Users\admin_user\Favorites\
Property(S): NetHoodFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Network Shortcuts\
Property(S): PersonalFolder = C:\Users\admin_user\Documents\
Property(S): PrintHoodFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\
Property(S): RecentFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\Recent\
Property(S): SendToFolder = C:\Users\admin_user\AppData\Roaming\Microsoft\Windows\SendTo\
Property(S): TemplateFolder = C:\ProgramData\Microsoft\Windows\Templates\
Property(S): CommonAppDataFolder = C:\ProgramData\
Property(S): LocalAppDataFolder = C:\Users\admin_user\AppData\Local\
Property(S): MyPicturesFolder = C:\Users\admin_user\Pictures\
Property(S): AdminToolsFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\
Property(S): StartupFolder = C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Property(S): StartMenuFolder = C:\ProgramData\Microsoft\Windows\Start Menu\
Property(S): DesktopFolder = C:\Users\Public\Desktop\
Property(S): FontsFolder = C:\Windows\Fonts\
Property(S): GPTSupport = 1
Property(S): OLEAdvtSupport = 1
Property(S): ShellAdvtSupport = 1
Property(S): MsiAMD64 = 6
Property(S): Msix64 = 6
Property(S): Intel = 6
Property(S): PhysicalMemory = 8026
Property(S): VirtualMemory = 5897
Property(S): AdminUser = 1
Property(S): MsiTrueAdminUser = 1
Property(S): LogonUser = admin_user
Property(S): UserSID = S-1-5-21-2954139208-1844025400-3761949349-1274
Property(S): UserLanguageID = 1049
Property(S): ComputerName = PSAL0_TEST
Property(S): SystemLanguageID = 1049
Property(S): ScreenX = 1024
Property(S): ScreenY = 768
Property(S): CaptionHeight = 19
Property(S): BorderTop = 1
Property(S): BorderSide = 1
Property(S): TextHeight = 16
Property(S): TextInternalLeading = 3
Property(S): ColorBits = 32
Property(S): TTCSupport = 1
Property(S): Time = 18:51:35
Property(S): Date = 14.05.2025
Property(S): MsiNetAssemblySupport = 4.8.9037.0
Property(S): MsiWin32AssemblySupport = 6.3.19041.3636
Property(S): RedirectedDllSupport = 2
Property(S): MsiRunningElevated = 1
Property(S): USERNAME = user
Property(S): DATABASE = C:\Windows\Installer\21e70c.msi
Property(S): OriginalDatabase = C:\Program Files (x86)\ossec-agent\wazuh-agent-4.12.0-1.msi
Property(S): UILevel = 2
Property(S): ACTION = INSTALL
Property(S): MIGRATE = {4612144F-DAED-447A-A7E9-7483C78EF093}
Property(S): ROOTDRIVE = D:\
Property(S): CostingComplete = 1
Property(S): OutOfDiskSpace = 0
Property(S): OutOfNoRbDiskSpace = 0
Property(S): PrimaryVolumeSpaceAvailable = 0
Property(S): PrimaryVolumeSpaceRequired = 0
Property(S): PrimaryVolumeSpaceRemaining = 0
Property(S): INSTALLLEVEL = 1
Property(S): REMOVE = ALL
Property(S): SOURCEDIR = C:\Program Files (x86)\ossec-agent\
Property(S): SourcedirProduct = {80B7D7ED-A637-46F3-96FC-2F9EA44F9886}
MSI (s) (E0:AC) [18:51:35:632]: Note: 1: 1707
MSI (s) (E0:AC) [18:51:35:632]: Product: Wazuh Agent -- Installation completed successfully.
MSI (s) (E0:AC) [18:51:35:632]: Установщик Windows выполнил установку продукта. Продукт: Wazuh Agent. Версия: 4.12.0. Язык: 1033. Изготовитель: Wazuh, Inc.. Установка завершена с состоянием: 0.
MSI (s) (E0:AC) [18:51:35:636]: Deferring clean up of packages/files, if any exist
MSI (s) (E0:AC) [18:51:35:636]: MainEngineThread is returning 0
MSI (s) (E0:C0) [18:51:35:637]: No System Restore sequence number for this installation.
=== Logging stopped: 14.05.2025 18:51:35 ===
MSI (s) (E0:C0) [18:51:35:638]: User policy value 'DisableRollback' is 0
MSI (s) (E0:C0) [18:51:35:638]: Machine policy value 'DisableRollback' is 0
MSI (s) (E0:C0) [18:51:35:638]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (E0:C0) [18:51:35:638]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (E0:C0) [18:51:35:640]: Note: 1: 2265 2: 3: -2147287035
MSI (s) (E0:C0) [18:51:35:640]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
MSI (s) (E0:C0) [18:51:35:641]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (E0:C0) [18:51:35:642]: Destroying RemoteAPI object.
MSI (s) (E0:48) [18:51:35:642]: Custom Action Manager thread ending.
MSI (c) (C4:F4) [18:51:35:644]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (C4:F4) [18:51:35:644]: MainEngineThread is returning 0
=== Verbose logging stopped: 14.05.2025 18:51:35 ===
вторник, 13 мая 2025 г. в 06:58:45 UTC+3, Bony V John:
Андрей Игоревич
May 15, 2025, 2:32:01 AM5/15/25
to Wazuh | Mailing List
Thank you!
The thing is that I install wazuh agents on endpoints on a large scale using Kaspersky Internet Security and also using domain tools.
Below is the installation log and ossec.conf.
Glad you're with us.
The thing is that I install wazuh agents on endpoints on a large scale using Kaspersky Internet Security and also using domain tools.
Below is the installation log and ossec.conf.
Glad you're with us.
вторник, 13 мая 2025 г. в 10:58:45 UTC+7, Bony V John:
Message has been deleted
Bony V John
May 16, 2025, 7:16:52 AM5/16/25
to Wazuh | Mailing List
Hi,
Could you please let me know how you are performing the Wazuh agent uninstallation?
If you are using the PowerShell command:
msiexec.exe /x wazuh-agent-4.12.0-1.msi /qn
please note that the original Windows installer file is required for the unattended uninstallation process. You need to ensure that the same .msi package is available on the Windows endpoint.
After uninstalling, please run the following command to check if any Wazuh-related packages still exist:
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh*" }
Could you please explain the steps you followed to uninstall the agent, so that I can try to replicate the same issue on my end?
Also, please share the version of your Windows server which is showing this issue.
Ivan Sergeevich
May 16, 2025, 9:34:59 AM5/16/25
to Wazuh | Mailing List
hi, In my case, was there an attempt to automatically update agents via the Vazuh GUI,
removal was performed via Add/Remove Programs
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh*" } shows nothing
win10pro 22h2 19045.5854
removal was performed via Add/Remove Programs
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh*" } shows nothing
win10pro 22h2 19045.5854
пятница, 16 мая 2025 г. в 14:16:52 UTC+3, Bony V John:
Андрей Игоревич
May 19, 2025, 4:12:59 AM5/19/25
to Wazuh | Mailing List
Hello.
The removal was performed by the specified command with the file in the same directory. After removal, the Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh*" } command does not show the presence of the service. The steps were simple
- Removing the Wazuh agent from the endpoint
- Attempting to install a newer version of the agent for testing.
- I tried to manually delete the ossec-agent folder and the wazuh service.
After attempting to install, the server arguments and password no longer appeared in the file Ossec.conf
As of now, the agent cannot be restored to the endpoint
windows 10 - 1909 (18363 778)
The removal was performed by the specified command with the file in the same directory. After removal, the Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Wazuh*" } command does not show the presence of the service. The steps were simple
- Removing the Wazuh agent from the endpoint
- Attempting to install a newer version of the agent for testing.
- I tried to manually delete the ossec-agent folder and the wazuh service.
After attempting to install, the server arguments and password no longer appeared in the file Ossec.conf
As of now, the agent cannot be restored to the endpoint
windows 10 - 1909 (18363 778)
пятница, 16 мая 2025 г. в 18:16:52 UTC+7, Bony V John:
Bony V John
May 19, 2025, 7:00:32 AM5/19/25
to Wazuh | Mailing List
Please allow me some time to discuss this issue with my team. I will get back to you with an update as soon as possible. Thank you for your patience and understanding.
Bony V John
May 20, 2025, 3:06:25 AM5/20/25
to Wazuh | Mailing List
Hi Андрей Игоревич,
You mentioned that you are uninstalling the Wazuh agent using PowerShell. To properly uninstall the agent, you need to use the same version of the Wazuh agent package that is currently installed on the endpoint.
Please refer to the Wazuh documentation for instructions on uninstalling the agent via PowerShell.
.png?part=0.1&view=1)
Download the same version of the Wazuh agent that is currently installed.
You can find it on the Wazuh Windows agent installation page.
Ensure the version matches the one installed on your system.-
Run the uninstall command using PowerShell and wait a few minutes to allow the uninstallation process to complete.
-
Verify uninstallation by checking the Apps & Features section in Windows Settings to ensure the agent has been removed.
.png?part=0.2&view=1)
You can use the following PowerShell command to download and install a new agent package:
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.12.0-1.msi -OutFile $env:tmp\wazuh-agent; msiexec.exe /i $env:tmp\wazuh-agent /q WAZUH_MANAGER='192.168.161.128' WAZUH_AGENT_GROUP='default' WAZUH_AGENT_NAME='win10'
Replace the version (4.12.0-1) in the URL with the one that matches your Wazuh manager version.
If you encounter any errors while executing this command, please share the error message with us for further assistance.
If your goal is to upgrade the Wazuh agent, you don’t need to uninstall it manually. Wazuh supports remote agent upgrades as long as the manager and agent versions are compatible.
You can refer to the Wazuh remote upgrade documentation for guidance.
You can refer to the Wazuh remote upgrade documentation for guidance.
Hi Ivan, your case seems slightly different as you attempted a remote upgrade and the versions also different. Could you please create a separate post for your issue?
This will help us focus on each case individually and assist you more effectively.
This will help us focus on each case individually and assist you more effectively.
Reply all
Reply to author
Forward
0 new messages