Can't install Anyconnect 4.6.04056

[Phesto]

Hi,

Trying to install anyconnect-win-4.6.04056-core-vpn-webdeploy-k9.exe on Win10 laptop. I have been using older versions of Anyconnect.

Installation fails after "Starting services..." with "There is a problem with this Windows Installer package. A program run as part...."

This is where it seems to fail in the setupapi.dev.log file:

idb: {Publish Driver Package: exit(0x00000000)} 01:16:35.670
sto: {DRIVERSTORE IMPORT END} 01:16:35.685
dvi: Flushed all driver package files to disk. Time = 16 ms
!!! sig: Failed to install catalog 'vpnva-6.cat' as 'oem9.cat'. Error = 0x00000005
sto: {DRIVERSTORE IMPORT END: exit(0x00000005)} 01:16:35.717
sto: Flushed driver database node 'DRIVERS'. Time = 0 ms
sto: Flushed driver database node 'SYSTEM'. Time = 0 ms
sto: Rolled back driver package publishing.
sto: Rolled back driver package registration.
sto: Rolled back driver package import.
!!! sto: Failed to import driver package into Driver Store. Error = 0x00000005
sto: {Stage Driver Package: exit(0x00000005)} 01:16:35.732
sto: {Setup Import Driver Package - exit (0x00000005)} 01:16:35.748
!!! ndv: Driver package import failed for device.
!!! ndv: Error 5: Access is denied.

I can't figure out what it is trying to do with "install catalog". I tried opening up all permissions on CatRoot, INF, and FileRepository folders under Windows. I also deleted the oem9.cat file under CatRoot in case it was getting in the way. But that didn't work. I renamed CatRoot2 to CatRoot2_old and let Windows recreate it. Then the process errored even earlier up, like it couldn't verify the digital signature in the package. I put the old CatRoot2 folder back and continue to get this error.

Any help would be greatly appreciated!

Thanks,

Chris

[patoberli]

Try to first uninstall the old AnyConnect version, reboot and then install the new version.
Which is the old version you are using?

[Phesto]

Hi, thanks for the reply.

It seems like the old version had been uninstalled prior to my installation attempts. I believe I was using version 4.4.03034, as I see this .exe in the Downloads folder. I tried re-installing the old version, but I get the same error.

So yeah, there seems to be no older version installed on my laptop; no Cisco program shows up in Programs and Features, for instance. I can't figure out what needs permission where to get the install to work. Any additional help is appreciated.

[patoberli]

Typically you just doubleclick the .msi file (if using the standalone installer), click several times next and done. Maybe a local firewall or protection software is blocking the installation. I had such issues in the past with old Malwarebytes versions and enabled system protection features.
If you are the admin of the ASA, download the .iso file for Windows at Cisco, extract the iso and try the installation with the file anyconnect-win-4.6.04056-core-vpn-predeploy-k9.msi
Your user does have administrator rights on the computer, right?

[bern81]

Hi @patoberli ,

As far as i know it is the opposite.

To install the anyconnect from ASA directly to the PC you need the Webdeploy version (First install you need admin access but if for upgrading to new anyconnect version does not need admin access)

For upgrade you need to enable the option in the anyconnect Client profile to allow update

To install manually directly on the PC or via SCCM, you need to install the Predeploy version (need admin access on the PC)

Please rate if this is helpful by clicking on the star below.

Please rate if this is helpful.

[Phesto]

The only security software I have on the machine is WIN Defender. I think that if it was blocking the install, it would have happened earlier in the process or give me a message, but perhaps not.

I do have admin rights on the laptop, and am running the installation as administrator, but don't have access to the .msi file you suggest, as far as I can tell.

I guess I'm interested in what operation is trying to be performed based on these lines in the log, as this is the first error I see:

sto: {DRIVERSTORE IMPORT END} 15:07:53.852
dvi: Flushed all driver package files to disk. Time = 0 ms
!!! sig: Failed to install catalog 'vpnva-6.cat' as 'oem9.cat'. Error = 0x00000005
sto: {DRIVERSTORE IMPORT END: exit(0x00000005)} 15:07:53.867

I'm mystified by this line in the log: Access is denied when trying to "install vpnva-6.cat as oem9.cat". Is this just a file copy in a certain directory? I've tried to open up all kinds of permissions on the system, but not sure what the installer is trying to do here.

Thanks for any additional info.

[bern81]

Hi,

Download the predeploy version and try to install it, normally there should not be any issue.

As i mentioned Webdeploy works if you want to push the installation from the ASA when the user connects for the first type via

Clientless SSL VPN, it will open a window that lets you choose to install or automatic installation depending on what you configure in the Group Policy.

We have anyconnect 4.6 in our environment and we installed it via SCCM-Predeploy with no issue.

[Richard Burts]

I think that bern81 is suggesting something significant. In the original post we are told that the software being installed is

anyconnect-win-4.6.04056-core-vpn-webdeploy-k9.exe

We are not told whether the attempt to install is by putting it on an ASA and then having the PC pull it from the ASA or whether the install is attempted manually on the PC. I am guessing that this is a manual install. As bern81 points out there is a version of the software intended for local manual installation but that does not appear to be what the original poster is using.

HTH

Rick

[patoberli]

I think it tries to install the VPN Adapter Driver at this step. Please note, there shouldn't be any other VPN software installed on the system, although it can work in many cases.
But yeah, make sure you have the right file for the installation.

The file for the ASA (which gets renamed when you download it from the ASA) is: anyconnect-win-4.6.01103-webdeploy-k9.pkg (version number varies). This is the file the ASA admin has to upload to the ASA. The file you, as a user, should receive in your browser for download, after authentication, is named anyconnect-win-4.6.01103-webdeploy-k9.exe.

The standalone installer, which would be provided from a website (not ASA!) or memory stick or similar is anyconnect-win-4.6.01103-core-vpn-predeploy-k9.msi.

[Phesto]

Hi, thanks for the replies.

I acquired the file for installation by logging on via my university's website with my credentials. The attached screen is then provided, and the file is downloaded to my laptop. The instructions tell me to locate the file (which is the webdeploy file) and then double-click it for installation. It fails as described in my original post. I don't have access to the predeploy file.

I had added another reply emphasizing the log file error I'm getting, but it seems to have been deleted?

There is no other VPN software installed on my laptop.

The error logged is about installing the .cat file as oem9.cat. The error is access is denied. I assumed the problem is with permissions somewhere but am not sure what process/directories are in play when the .cat file is trying to be installed. Anyone know? I have admin rights on my laptop.

Thanks.

[Phesto]

Hi, I got the file anyconnect-win-4.6.04056-core-vpn-predeploy-k9.msi and attempted to install it. It also errored. It generated a lengthy msi.log file that I'm currently looking through. It's attached if anyone is curious.

Thanks.

[Richard Burts]

Thanks for the update. I did look at your screenshot and am surprised that they would have you down load the webdeploy rather than the predeploy version. I had hoped that getting the predeploy version would solve the issue and sorry that it did not. Since the predeploy also has issues there is apparently more to the problem than which version of code to use. Good luck in getting it resolved.

HTH

Rick

[Phesto]

Thanks. Looking through the msi.log file, I see this:

MSI (s) (E4:74) [14:50:45:737]: Executing op: CustomActionSchedule(Action=VACon64_ndis6_Install,ActionType=3090,Source=C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe,Target=-install "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA,)
CustomAction VACon64_ndis6_Install returned actual error code 5 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (E4:74) [14:50:47:152]: Note: 1: 1722 2: VACon64_ndis6_Install 3: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe 4: -install "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA
Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action VACon64_ndis6_Install, location: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe, command: -install "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA

Seems like access denied on installing the vpnva-6.inf file. I keep thinking that there are some permissions that need to be set correctly but am not sure what user and what location (either folders or registry) are involved.

[patoberli]

With a normal Windows installation, no permissions need to be set in any way.
Just to be sure, you successfully uninstalled the old version?
Check in task manager if there really is no VACon64.exe process running.
There is a tiny possibility that the file is corrupted, right click the .msi file, Properties - Digital Signature - select it and Details and if it says that the signature is OK, then the file should not be corrupted.
I think you might have a broken AnyConnect driver on your system.
For testing, can you open Device Manager, expand Network Adapters, select View - Show hidden devices. If you have anything from Cisco under the Network Adapters, right click it and select Uninstall.

[Phesto · Accepted solution]

Sorry for not following up earlier -- in the small chance anyone else has this problem...

I was able to install the VPN finally after changing Cryptographic Services (or CryptSvc) under services.msc to run as "Network Service" rather than "Local system", which is what it had been set to "Log On As".