locked
EMET 4.0 installation fails with error code 1720 RRS feed

  • Question

  • On many, but not all, of our systems (Server 2008 R2), installation of EMET 4.0 is failing. Here is an excerpt from the verbose MSI log:

     

    REM kill EMET Agent 4.0 process if running (re-installing scenario) strAppName = "emet_agent.exe"
    Set objProces
    MSI (s) (A0:50) [10:55:47:325]: Creating MSIHANDLE (27) of type 790536 for thread 6736 MSI (s) (A0:F0) [10:55:47:325]: Creating MSIHANDLE (28) of type 0 for thread 1520 MSI (s) (A0:38) [10:55:47:325]: Generating random cookie.
    MSI (s) (A0:38) [10:55:47:325]: Created Custom Action Server with PID 6588 (0x19BC).
    MSI (s) (A0:DC) [10:55:47:434]: Running as a service.
    MSI (s) (A0:DC) [10:55:47:434]: Hello, I'm your 32bit Elevated custom action server.
    MSI (s) (A0:F0) [10:55:47:512]: Note: 1: 2262 2: Error 3: -2147287038 MSI (c) (C8:B4) [10:55:47:512]: Note: 1: 2262 2: Error 3: -2147287038
    DEBUG: Error 2835:  The control ErrorIcon was not found on dialog ErrorDialog The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2835. The arguments are: ErrorIcon, ErrorDialog, MSI (s) (A0:F0) [10:55:52:223]: Note: 1: 2262 2: Error 3: -2147287038 MSI (s) (A0:F0) [10:55:52:223]: Product: EMET 4.0 -- Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action _FA2E7A16_A819_4F3A_AB7E_0A039BE81BD7 script error -2147024770, :  Line 21, Column 1, 

    MSI (s) (A0:F0) [10:55:52:223]: Closing MSIHANDLE (28) of type 0 for thread 1520 MSI (s) (A0:F0) [10:55:52:223]: Closing MSIHANDLE (27) of type 790536 for thread 6736 Action ended 10:55:52: InstallExecute. Return value 3.

    Monday, September 23, 2013 9:02 PM

All replies

  • _FA2E7A16_A819_4F3A_AB7E_0A039BE81BD7 refers the Custom Install Action Blob _6A58D16B437E5B268B3B9D09B8746240 which conatins this vb script in EMET 4.1:

    ' Begin
    REM kill the old EMET 3.0 Notifier process if running (upgrade scenario)
    strAppName = "emet_notifier.exe"
    Set objProcesses = GetObject("winmgmts://" & strMachine).ExecQuery("SELECT * FROM Win32_Process WHERE Caption LIKE '" & strAppName & "'")
    For Each objProcess In objProcesses
        intRetVal = objProcess.Terminate(0)
    Next

    REM kill EMET Agent 4.0 process if running (re-installing scenario)
    strAppName = "emet_agent.exe"
    Set objProcesses = GetObject("winmgmts://" & strMachine).ExecQuery("SELECT * FROM Win32_Process WHERE Caption LIKE '" & strAppName & "'")
    For Each objProcess In objProcesses
        intRetVal = objProcess.Terminate(0)
    Next
    ' End

    You might try to run it manually to test what goes wrong.

    Tuesday, December 10, 2013 12:13 PM
  • I've just spent the last 6 hours trying to find a solution to this. All the steps provided by other user never worked. Running the script separately worked just fine (and YES I was running it as admin). Basically I've come up with a workaround.  

    The section it's failing on is a CustomAction(VBSCRIPT) that the MSI is calling to 'look for' & 'close' emet_notifier.exe or emet_agent.exe. I know it's not there because I manually removed EMET. When you modify the MSI you can pull out the CustomActions piece that is failing.

    Step 1: Modify the MSI using Orca. Orca is provided by MS in the SDK Tools. I found this site helpful for getting Orca installed on Windows 7:

    http://blogs.technet.com/b/bernhard_frank/archive/2010/03/15/how-to-install-orca-exe-from-the-windows-installer-development-tools.aspx

    Step 2: After installing Orca, right click EMET Setup.msi and select 'Edit with Orca'

    Step 3: Find all instances of the Custom Action and Drop the Rows: Find > _FA2E7A16_A819_4F3A_AB7E_0A039BE81BD7.  (Right Click each row found and select 'Drop Row'. I found 4 Rows with this entry)

    File > Save (or Save As) and Run the MSI.

    EMET installed without problems.  Since it doesn't actually fix the problem with Windows (it only fixes the MSI), you'll have to modify future releases of the MSI the same way for that particular PC.  

    Wednesday, March 26, 2014 6:27 PM
  • Instead of modifiying the msi it might also help to kill the processes before starting the msi for example with commands on the classic shell:

    "%Systemroot%\System32\taskkill.exe" /f /im "emet_agent.exe"
    "%Systemroot%\System32\taskkill.exe" /f /im "emet_notifier.exe"

    However, the systems you have the problems with probably have other issues that cause the setup to fail.

    You may have tried to test it elevated but also in the SYSTEM context? You may try it there with psexec:

    .\psexec.exe -s -h -i c:\windows\sysnative\cmd.exe

    Does it also happen with the EMET 4.1 and 5.0 TP MSI?

    Friday, March 28, 2014 7:24 AM
  • This solution worked for me.  I copied and pasted a text file with these instructions into my Emet install folder, so I'll see it there the next time I download a version.

    My symptoms were the same.  Script ran great by itself because Emet wasn't installed at all.

    Hopefully they fix this in version 5.

    Thursday, June 5, 2014 5:30 PM