Manual FSA Agent install fails

[iternity]

Hello,

I get an "Access is denied" error when I try to remotely install the agent on a file server. The Deployment check says the file permissions are ok, e.g. that the vault service account has the local admin rights on the filre server. I was then advised to install  the fsa agent manully.

I ran vcredist_x86, then the FSA agent .msi installer (x64). The first problem I am noticing is with the credentials. Neither the vault service account nor the domain account is accepted. Only if I type in Administrator by itself will it work. This behavior is regardless if I am logged in as  local admin, domain admin or vault service account.

During the install, I get a message "Couldn't create service" for the File Collector Service. It does install the other two (Placeholder and Blocking) fine and they can be started. But the installation does not succeed and a cancel will remove the two running services as well.

Any advice on this? We have the following VMWare setup:

- DC is Server 2008, SP2  Standard 64bit; has the SQL Server 2008 64 bit
- EV 8.0 SP2 is on Server 2003 R2, SP2 Standard 32bit
- File Server is on Server 2008 Standard 64bit

From the EV machine I can access the C: Drive on the file server (and shares if  I gave permissions for vault service account) as well as the registry.

thanks!
bjorn

[Nick_White]

When you run the msi manually an installation log file should be created. Can you check in there for errors or alternatively post it here so we can try to work out why it is failing please?

[iternity]

Hi Nick,

thanks for the quick reply. I assume this should be located on the file server,  not on the EV server? I can't find an install log on the FS - I searched the C: drive for "install" and did not find anything. I also checked  the Enterprise Vault\Program Files (x86) dir and did not find an install log.

thanks,
bjorn

[Nick_White]

Bjorn, if you can't find a log file try using the /log <logfile> switch from the command line for the msi

[JesusWept3]

i've seen this before where you have to type the FQDN of the domain and not the netbios name
(i.e DOMAIN.ENTERPRISE.VAULT as opposed to DOMAIN)

[iternity]

Log file attached, thanks for pointing out the option! I glanced over it and saw two problems (missing ISScript and SCMOpenService failures). Don't know if they are related. I also see again that File Collector complains about permissions to start the service ( I was able to start the other two services, so I assume permissions should be fine in general).

thanks!
bjorn

[Nick_White]

Could you try to generate a log file when specifying the Vault Service Account. The services need to run under that account so we need to work out why it is failing when you enter the password in the dialog box

[juggernaut1]

I see that you ran the vcredist_x86 but was wondering if you ran the other as well

From the install guide:
On a 64-bit Windows system, run vcredist_x86.exe and then
vcredist_x64.exe

I had a problem similar and this is what  I did, I had overlooked those two files...

[iternity]

Nick, I typed that in once when I created the log and received a failure. Domain is iternity.com, vault service account is evault1 (so I used iternity.com\evault1 as username and the corresponding pw). Not sure why this attempt didn't make it into the log. I will try again.
Also note that I did use the FQDN as suggested by JesusWept2  (weeping as well :)

thanks,
bjorn

[Nick_White]

It may not be logging the failed attempts. The SCMOpenService() failed is happening because it is checking to see if the services exist, which they don't at that point in time, so this looks like it's ok. The subsequent errors around permissions are kind of irrelevant as the account isn't the one that the service will be running under

Aside from juggernaut's suggestion above which is worth trying, are you logged on to the file server as evault1? If not I would be interested to see what happens if you run the installer under the EV service account on the file server

[iternity]

Thanks juggernaut1, I missed that. Unfortunately, it didn't make  a difference. Does it matter which version to use? I have two FS available. I installed vcredist_x86 2008 on FS1. On FS2 I got a message that I can only install 2005 SP1 (or was it 2?). Now I installed vcredist_x64.exe 2008 on FS1 and I get the same errors. Haven't tried vcredist_x64.exe 2005 on FS 2 yet.

Nick, I tried again logging as the vault service account. Same result. It does seem that some, but not all failed login attempts are logged. In the attached log file I tried logging in twice, but it was recoorded only once.

bjorn

[juggernaut1]

Have you checked Win 2008 firewall settings, I would turn it off, and I would also disable UAC on the Windows 2008 server, you will need a reboot after you disable UAC.  Are you running the vcredist from the evpush folder, if not the Program Files/Enterprise Vault/evpush/agent  folder should have both of them in there?

[iternity]

firewalls are all turned off. Not sure about UAC, will check. I downloaded the vcredist and ran them directly on the File Servers.

[iternity]

Turning off UAC did not help either. I have noticed one weird thing with the machines. When I look in the Administrators group, the vault service account does not show up. But when I try to add it it says it is already there (which I expect since adding this was one of the earlier steps in the EV setup). 

bjorn

[JesusWept3]

iternity,
I know this is gonna sound weird, but can you try DOMAIN\USERNAME (as in all caps)

[juggernaut1]

Is your Windows 2008 server R2?

[juggernaut1]

can you send a screen shot of this?

Right click 'My Computer' and choose Manage

Go to local users and groups.

Click open the 'Administrators' group and add the user in the members list

[iternity]

@JesusWept2: Yes, this did sound weird, sincxe it is supposed to be case insensitive. I tried it anyway, without luck (tried both ITERNITY and ITERNITY.COM)

@juggernaut1: No, the Windows 2008 are not R2
I have the screen  shots with short description attached in a word doc. As I mentioned yesterday, the behavior is a little odd.

thanks,
bjorn

[juggernaut1]

can you run net localgroup administrators from cmd prompt and send the output?

[iternity]

This is giving the same result. Listing them returns only Administrator. Trying to add evault1 yields the message "System error 1378 has occurred. The specified account name is already a member of the group."