Software Deployment

Just as a matter of interest , if you set it to run "Anytime" does it work??

Hobbsy,

Yes, when the Managed installer is set to 'Anytime' it works without issue. 

maybe my issue is:

Could it be, the .msi gets transferred when the Managed installer instructions are set to kick off (on the restart) but there's no tunnel to get it from my KACE SMA server? 
I spun up a VM testbox in my vCenter, connected to the my internal LAN, and there were zero issues with the managed installer when set to 'at Bootup' 

Things that make you say 'Hmmm.." -mikey

UPDATE: 

A simple online KScript was put together and executed to my target test machine

<?xml version="1.0" encoding="utf-8" ?>

<kbots xmlns="http://kace.com/Kbots.xsd">

<kbot>

<config name="Pulse Upgrade Pre-req" type="policy" id="361" version="1658869066" description="Copies prerequisite files for Pulse Install">

  <dependencies>

    <dependency name="/packages/kbots/361/copyPulse.bat" checksum="58101f360513099326fde6e7e10351d3"  />

    <dependency name="/packages/kbots/361/ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi" checksum="8f9da1466cb5415a45a512341549b12e"  />

  </dependencies>

  <execute disconnected="false" logged_off="true">

  </execute>

</config>

<compliance>

  <verify on_failure="break" attempts="1">

    <launch_program path="$(KACE_DEPENDENCY_DIR)" program="copyPulse.bat" wait="true" visible="false" parms="" />

    <on_verify_success>

    </on_verify_success>

    <on_verify_failure>

      <on_remediation_success>

      </on_remediation_success>

      <on_remediation_failure>

      </on_remediation_failure>

    </on_verify_failure>

  </verify>

</compliance>

</kbot>

</kbots>

"CopyPulse.bat" basically just moves the MSI package 

from C:\ProgramData\Quest\KACE\kbots_cache\Packages\361\

to C:\Temp\ (because the '361' folder gets deleted after next check-in)

Verified the MSI is in C:\Temp

Modifiied the Managed Installer: 

• Associated File: ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi
• Installation Options: 
• Override default installation - Full Command Line: c:\windows\system32\msiexec.exe /qn /i "C:\temp\ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi"
• Run Command only (do not download file)
• added my test box in the Devices list
• removed the link for the SmartLabel (for now) 

Ran the Managed installer to force a check-in of my target. and validated the new check in

Did a restart of my target, same behavior. 

KACE installer ambush message appeared after the restart for about 1 second then dropped. 

Signed into the machine, observed no Pulse upgrade. Grrrr.

Could it be that Microsoft (in its infinate wisdom) is not allowing Msiexec.exe to run when no user is signed in? 

My patience is nearing its end LOL! 

-mikey

I'm starting to think my answer is No. 

created a custom view in the Event Viewer on my target

Criteria - By Source: MsiInstaller

Event Level - ALL 

I found no events pertaining to Pulse Secure. 

Perhaps you should look into KACE's File Synchronization feature.

At this point in troubleshooting, the original issue is resolved. 

MSI installer transfered to client - Good

Execute the Managed installer on 'at bootup' (off VPN) - Not Good, still pending

And...The Saga continues

BNewland,

Thanks for the suggestion! It like that solution better, its cleaner, thanks! 

I have the File Sync package dropping my msi into C:\ProgramData\Quest\KACE\Installers\Pulse. 

After verification the installer exists in that location, I tweaked the Managed installer: 

• Override Default Install / Full command Line: msiexec.exe /qn /i "C:\ProgramData\Quest\KACE\Installers\Pulse\ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi"
• Run Command Only (do not install) 
• Alernate location (ticked) 
• Path: C:\ProgramData\Quest\KACE\Installers\Pulse\ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi
• Checksum: [copied from the KScript]
• Credential: (Windows Builtin Local Administrator Account) - ".\administrator"
• 
  

Managed Installer - Saved then 'Run Now', to force a client check-in

Rebooted the client. 

Same behavior is observed. (KACE ambush message is seen then quickly drops)

I think the root cause of this failure are the creds to authorize the install.

Like in internal combustion engine, 3 barebones basic things are needed: 

• Power, Hardware, and running OS (Air) 
• the MSI installer (Fuel) 
• Credentials (Spark) 

No matter what, the client needs the creds from my KACE server at the time of execution, but like before, No VPN tunnel,  no KACE server, and getting the cred fails.

It requires the cred at execution only because its an MSI installer.

I have another Managed Installer configured 'at bootup' that uses an .exe and it works fine when the client is off VPN. 

To my knowledge,  Ivanti has never built an .exe version of the Pulse Secure, only an .msi.  (bummer)

Back to the brainstorming table. 

-mikey

UPDATE: 

An offline KScript was built to handle the installer (Managed Installer eliminated) 

---Description: install Pulse Secure, in-place upgrade, just after user signs into Windows 10; No VPN

---File Dependencies

Phase_1.bat
ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi
pulse.reg
Pulse91R15_Inst.bat
---Notes

Task 1

step 1- KScript is executed; Copies Dependency files to temp location in: C:\ProgramData\Quest\KACE\kbots_cache\Packages\kbots\364\ folder on the client machine.
step 2- Execute 'Phase_1.bat'.
step 2a - the .bat copies .msi installer & Pulse91R15_Inst.bat to C:\Temp\
step 2b - and merge 'pulse.reg' snippet into the registry, silently
Location: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
new string name "InstallPulse9115" value="C:\Temp\Pulse91R15_Inst.bat"
step 3 - [Machine Restarts]
step 4 - RunOnce triggers the 'Pulse91R15_Inst.bat' in C:\Temp\ then Registry String is removed.

Pulse91R15_Inst.bat = msiexec.exe /qn /i C:\Temp\ps-pulse-win-9.1r15.0-b15819-64bit-installer.msi

The issue: This works only if an local administrator or a domain admin is signed into Windows on the target. If a domain user is signed in, Step 1 is successful, but that's as far as it gets; Step 2 doesn't trigger.

Next train of thought: configure a task in Windows Task Scheduler via Powershell (pushed by a the KScript) so it runs the subsequent steps as the local administrator, but I don't believe there's a way to clean up the task after running once. 

Back to the brainstorming table, again
Ivanti is engaged to see if they can build an .exe installer for Pulse. 

The other avenue is submitting a support Request with Quest. 

UPDATE: 

Ivanti support is engaged to see if they can build an .exe installer for me. 

Quest service request ticket is opened. # 5143854

Hopefully we can figure out how to cache encrypted credentials on the target for the Pulse .msi installer so it will install 'at bootup' 

Updates to follow