MSI installer fails with 1603

Version 1

    Verified Product Versions

    AppSense Performance Manager 8.1AppSense Performance Manager 8.0AppSense Application Manager 8.0AppSense Application Manager 8.1

    Introduction

    When installing Performance Manager or Application Manager the installer fails with error code 1603. This can be seen in the Management Center or when MSI is manually installed with verbose logging enabled.

    EXAMPLE: MSI verbose logging will display the following  (for Performance Manager):

    DIFXAPP: INFO:   PmUserMem.inf: checking signature with catalog 'C:\Program Files\AppSense\Performance Manager\Agent\Drivers\User Memory\PmUserMem.cat' ...
    DIFXAPP: ERROR:  Signature verification failed while checking integrity of driver package 'PmUserMem.inf' ('C:\Program Files\AppSense\Performance Manager\Agent\Drivers\User Memory\PmUserMem.inf'). (Error code 0xE0000244.)
    DIFXAPP: INFO:   Successfully removed '{6D0B128F-FA21-4CF9-8B26-7C9A5BBE8209}' from reference list of driver store entry ''
    DIFXAPP: INFO:   RETURN: DriverPackageInstallW  (0xE0000244)
    DIFXAPP: ERROR: encountered while installing driver package 'C:\Program Files\AppSense\Performance Manager\Agent\Drivers\User Memory\PmUserMem.inf'
    DIFXAPP: ERROR: InstallDriverPackages failed with error 0xE0000244
    DIFXAPP: RETURN: InstallDriverPackages() 3758096964 (0xE0000244)

    Or (for Application Manager):

    DIFXAPP: INFO:   ENTER:  DriverPackageInstallW
    DIFXAPP: INFO:   AMFilterDriver.inf: checking signature with catalog 'C:\Program Files\AppSense\Application Manager\Agent\AmFilterInstall\AMFilterDriver.cat' ...
    DIFXAPP: ERROR:  Signature verification failed while checking integrity of driver package 'AMFilterDriver.inf' ('C:\Program Files\AppSense\Application Manager\Agent\AmFilterInstall\AMFilterDriver.inf'). (Error code 0x800B0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.)
    DIFXAPP: INFO:   Successfully removed '{DA8E03A7-ACD8-42F6-8307-96C4342AA826}' from reference list of driver store entry ''
    DIFXAPP: INFO:   RETURN: DriverPackageInstallW  (0x800B0100)
    DIFXAPP: ERROR: encountered while installing driver package 'C:\Program Files\AppSense\Application Manager\Agent\AmFilterInstall\AMFilterDriver.inf'
    DIFXAPP: ERROR: InstallDriverPackages failed with error 0x800B0100
    DIFXAPP: RETURN: InstallDriverPackages() 2148204800 (0x800B0100)
    Action ended 16:57:06: InstallFinalize. Return value 3.

    Detail

    The Performance Manager and Application Manager MSI is signed with a digital certificate, if the certificate chain cannot be validated the driver cannot be installed.

    This issue can occur if the machine's root certificates are not correctly updated, or when the machine doesn't have internet connection and therefore the required root certificates validation will fail.

    TIP: To verify if the correct and valid root certificate is available, right click on the PerformanceManagerAgent32/64.msi or ApplicationManager32/64.msi and select the tab Digital Signatures. Click on Details, if the certificate signature cannot be verified you will see a similar error to the Screenshot below.

     

     

    To resolve this issue you will need to update the root certificates on the endpoint(s) ahead of software installation to ensure the root validation is successful.

    The required root certificate is as follows:

    • VeriSign Class 3 Public Primary Certification Authority - G5
    • Thumbprint = 4e b6 d5 78 49 9b 1c cf 5f 58 1e ad 56 be 3d 9b 67 44 a5 e5

    The root certificate package can be downloaded from Verisign [now Symantec].

    https://www.symantec.com/page.jsp?id=roots

     

    On Windows XP / 2003 the certificate would need to be downloaded and deployed to the endpoints using a technology such as group policy (see https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_pkpuncertroot.mspx?mfr=true )

    Windows Vista and higher can update their trusted roots via Windows update and have further deployment flexibility - see http://support.microsoft.com/kb/931125 for further details on the options available.