Unable to install Anyconnect 4.8-4.10 Error 1722

[yacobean]

Had anyconnect 4.9 on my computer. Tried updating to anyconnect 4.10 but the update has failed. Got a "catastrophic" failure.*** error. Removed all Cisco apps from the computer. Deleted all Cisco folders from program files/program data/appdata. When installing any anyconnect version it will start to download and then rollback. It will say it's installed, but the only thing installed is the diagnostic tool. The event viewer says "Cisco AnyConnect Secure Mobility Client -- Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action VACon64_ndis6_Install, location: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe, command: -install "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA." Which I know there has been other forums about this. None of them are helpful and most of them are really old. The system is Windows 10 enterprise 1909. AV is Sophos. Other machine on the domain have been able to update. Tried deleting all anyconnect registry key. All the services that need to be on are on. Not sure what to do at this point.      

[stsargen]

Please provide a DART bundle of the failed install.

[yacobean]

Got the Dart Bundle. Due to security reason I can't post the full bundle. Is there a certain log you need? 

[stsargen]

Can you post the setupapi.dev.log file.

[stsargen]

Hi,

This is a known issue that has to do with removal of SHA-1 certificates from your system.  My guess is that the certificates that were used to sign the VPN virtual adapter have been removed from your PC.  You would need to reinstall the required certificates to your system  You can probably look at C:\Windows\System32\drivers\vpnva64-6.sys on a working system to see what Root certificates are required.  This issue will be fixed in an upcoming release that uses SHA-256 certificates for signing.

Thanks

[yacobean]

Are you talking about this? How would I download the Certs on the machine that isn't working?

[stsargen]

Yes, That is the correct location.  Many different certificates are used.  You should check each chain and make sure you have them all installed.  You could export the needed certificates from a working machine.

[yacobean]

The computer has the Certificates. Just in case I exported the certs from a known good machine and installed them under both local/machine. Tried the install again and got the same results. When I check the machine C:\Windows\System32\drivers and vpnva64-6.sys was missing. Copied over the known good machine and paste vpnva64-6.sys into the driver folder. Still doesn't work, getting the same error in event viewer.