https://github.com/osquery/osquery logo
Title
w

wkleinhenz

01/15/2021, 3:13 PM
im having a hard time deploying a compiled service MSI for windows, im basically getting an error related to not having the right permission to create a system service, ive tried with the local system account and a user that has the privilege to logon as a service and i just cant get it to work, an old version or service shouldnt remain, im deploying with PDQ not sure how much that would matter
im using 0.11.17 for reference
s

seph

01/15/2021, 3:19 PM
Is this an error that looks like
Verify you have sufficient privileges to start system services
?
w

wkleinhenz

01/15/2021, 3:20 PM
yeah thats the one
s

seph

01/15/2021, 3:20 PM
That’s an generic windows error that covers any problem with service installation (not just permissions)
w

wkleinhenz

01/15/2021, 3:20 PM
actually its a bit different
its says install rather then start but i imagine its similarly vague
s

seph

01/15/2021, 3:21 PM
All the occurrences I’ve found have been traced to what I can only describe as a bug in service manager. Did you have a version of this service installed prior?
w

wkleinhenz

01/15/2021, 3:22 PM
i think so, im doing both an uninstall and an attempt to clean up the old services with powershell just in case
s

seph

01/15/2021, 3:22 PM
The only fix I’ve found is to reboot after the uninstall.
w

wkleinhenz

01/15/2021, 3:22 PM
gross
ok ill have to plan something then
s

seph

01/15/2021, 3:23 PM
This seems to happen if the service control panel is open, when you uninstall a service. This leaves that service in a weird limbo state. Subsequent installs fail with that, until it’s been rebooted.
I have no idea what “correct” is here. This all just feels like a windows bug.
w

wkleinhenz

01/15/2021, 3:23 PM
ok that must be why its not every host
i might not get back on this soon but ill see if i cant schedule something soon
s

seph

01/15/2021, 3:24 PM
I haven’t seen it happen in normal MSI upgrade/repair stuff. Only when people do uninstall/reinstall testing with lots of control panels open, and whatnot. Which, frustratingly, means I hit it randomly testing
w

wkleinhenz

01/15/2021, 3:26 PM
ah ok so to do an update do i need to uninstall reinstall or is the launcher msi upgrade aware like how some tools are, the one that comes to mind for me is the splunk UF
s

seph

01/15/2021, 3:26 PM
I have no experience with splunk.
You mentioned custom building, so all bets are off.
w

wkleinhenz

01/15/2021, 3:27 PM
im just using the package-builder to build the msi, but i could see why that wouldnt be supported
s

seph

01/15/2021, 3:27 PM
But generally speaking, launcher will update itself. The MSI doesn’t change versions, but launcher will download and exec the newest versions. (If autouodate is enabled)
w

wkleinhenz

01/15/2021, 3:28 PM
yeah we cant use the auto updating function
s

seph

01/15/2021, 3:28 PM
Ah.
w

wkleinhenz

01/15/2021, 3:29 PM
so ive just been pulling the windows releases from github and using package-builder
s

seph

01/15/2021, 3:29 PM
What does upgrade aware mean? I think you should be able to install a new MSI straight over the old one. The various product and upgrade guids should be set correctly for that to work
w

wkleinhenz

01/15/2021, 3:29 PM
ok yeah so for example to upgrade the splunk uf you just run the new installer, no uninstall
s

seph

01/15/2021, 3:30 PM
Yeah, that should work.
w

wkleinhenz

01/15/2021, 3:30 PM
ok cool that should make things easier
s

seph

01/15/2021, 3:30 PM
Why doesn’t autoupgrade work in your environment?
w

wkleinhenz

01/15/2021, 3:32 PM
were an airgapped environment
s

seph

01/15/2021, 3:33 PM
Yup… You could run a notary nd download server internally, but I can’t really recommend that work.
w

wkleinhenz

01/15/2021, 3:33 PM
yeah its not too bad to run package builder and then use our deployment tools to distribute it
s

seph

01/15/2021, 3:35 PM
I’m glad
package-builder
is working for you
w

wkleinhenz

01/15/2021, 3:37 PM
yeah so far so good