AnyConnect MSI Update problem

[0x000000c]

Hi all,

I am currently trying to deploy an update for the Cisco AnyConnect VPN Client via Microsoft SCCM to Windows 7 / 8.1, that works for some computers.

On certain computers however, the client gets uninstalled and then fails to install (which results in upset users because they realize they can't start the VPN client any more, preferably in situations where they desperately need it...)

Not really sure if I'm at the right place to ask this question, please tell me if I am not.

More technical details:

- The deployment runs as a required install in the system context.

- This is the command I'm using to install the application: msiexec /i "anyconnect-win-3.1.06073-pre-deploy-k9.msi" /norestart /passive /L*V "C:\msi.log" TRANSFORMS=COMPANY.mst

- I'm not manually uninstalling the VPN client first, I let MSI handle the upgrade install.

- The .mst file only creates a desktop shortcut and the .msi file is not modified in any way.

I Attached the whole MSI logfile and hope that someone can see what the problem is. I am suspecting the following lines to be cause for the rollback but I'm not entirely sure what's causing it since the SYSTEM account has full access to the folders.

1. MSI (s) (A8:14) [08:25:33:331]: Note: 1: 1303 2: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help
2. MSI (s) (A8:14) [08:25:33:331]: Product: Cisco AnyConnect Secure Mobility Client -- Error 1303. The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help.  The installation cannot continue.  Log on as administrator or contact your system administrator.
3. Error 1303. The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help.  The installation cannot continue.  Log on as administrator or contact your system administrator.

I would appreciate it very much if someone can point me in the right direction here, this is really frustrating. Thanks!

[0x000000c]

Hi,

a quick update on how I solved the problem because I saw someone voting for this case: I used the Uninstall script from here to automatically remove any old version of AnyConnect before the install and didn't experience the above MSI error once again. I hope it helps someone. :)

[Shawn Merriman]

are you saying it is a Java issue, or you are saying that you modified a script like the one on that technet page, titled "Uninstalling all previous versions of Java runtime environment using application supersedence in Configuration Manager"

[0x000000c]

Well, "I used the Uninstall script from here to automatically remove any old version of AnyConnect before the install"...

I modified the script.

[Shawn Merriman]

Ah yes, we have found work-arounds for this issue as well. The 1303 error seems to be due to the MSI starting the install prior to the uninstall completing, so your work-around, uninstalling it yourself 1st, should take care of that. We also experienced other behaviors with the default upgrade installer from Cisco, where it would hang the windows installer (msiexec), causing the system to be in a state that no MSI would install, as it saw a previous MSI install in progress. This requires manual intervention to identify and then kill the Windows Installer service process as SYSTEM, clean the install registry entries, restart the Windows Installer service, and then start the upgrade over.

I would prefer for Cisco to address the issue with a new installer package.

[mushawl]

Can you please provide the script as the link to the script is not working

[ediswood]

Similar issue on the newer version 3.1.13015.  Just times out deploying through sccm, even on a machine that doesn't have anyconnect on it yet.

[Shawn Merriman]

off the top, what is the command line you are using? Running with administrative rights, wether the user is logged in or not?

msiexec /i anyconnect.msi /quiet /norestart REBOOT=ReallySuppress

[ediswood]

I've tried several variations at this point with the same result.

Whether or not the user is logged on, system context as an application and a package with admin rights.

First one I tried was in the Anyconnect deployment document:

msiexec /i anyconnect-win-ver-pre-deploy-k9.msi /norestart /passive /lvx*

Tried the one above:

msiexec /i "anyconnect-win-3.1.06073-pre-deploy-k9.msi" /norestart /passive /L*V

They all seem to timeout with error code 0x87d00213 in sccm.  One on a machine with anyconnect, the other does not.

[Shawn Merriman]

I did have issues with the package timing out, when using the log file command line argument. I would suggest removing that portion, just for a test.

Also, I do not see passive as being an option you would care to use, since when run as system, no-one can see a progress bar., so it may not be quiet. Perhaps just try your command local on the system you are setting at, in a DOS window, and see if there is a popup. I would stick with the /q (quiet) and no restart options.

https://msdn.microsoft.com/en-us/library/windows/desktop/aa372024(v=vs.85).aspx

[ediswood]

Looks like that was it, appreciate it!