Another Application Deployment Question

[Ted Pruitt]

Trying to install the Zoom video conferencing client (see attached image) It tells me there is a deployment error but no real information.

Any ideas where to start troubleshooting this?

it's a simple .exe which I put in the app pack itself, no switches.

It looks like the files get transferred, but it doesn't seem to know what to do with them.

I've included the configuration screens as well.

[SmartDeploySupport]

Hi Ted,

To troubleshoot this, we'll need to see your Application event log from the endpoint where you tried to deploy the application. 

C:\Windows\System32\winevt\Logs\Application.evtx

I've created a support ticket and will email you shortly with instructions to submit the file. 

Glenn
SmartDeploy Support

[Ted Pruitt]

Hey Glenn --

Yeah, I was just looking at that - appears to be a permissions issue:

Log Name:      Application
Source:        McAfee Endpoint Security
Date:          4/10/2019 10:38:07 AM
Event ID:      3
Task Category: None
Level:         Error
Keywords:      Classic
User:          SYSTEM
Computer:      PCSPI-Z240-2QGG.senatedem.local
Description:
EventID=1092

NT AUTHORITY\SYSTEM ran CLIENTSERVICE.EXE, which tried to access C:\WINDOWS\TEMP\SMARTDEPLOY\SCRATCH\APPLICATION MANAGER\ZOOM CLIENT\FILES, violating the rule "Prohibited", and was blocked. For information about how to respond to this event, see KB85494.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="McAfee Endpoint Security" />
    <EventID Qualifiers="8192">3</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-10T15:38:07.889268000Z" />
    <EventRecordID>61171</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PCSPI-Z240-2QGG.senatedem.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>EventID=1092

NT AUTHORITY\SYSTEM ran CLIENTSERVICE.EXE, which tried to access C:\WINDOWS\TEMP\SMARTDEPLOY\SCRATCH\APPLICATION MANAGER\ZOOM CLIENT\FILES, violating the rule "Prohibited", and was blocked. For information about how to respond to this event, see KB85494.</Data>
  </EventData>
</Event>

[Ted Pruitt]

Looking closer - it's McAfee blocking installation - but here's the weird thing - the two downloaded app packs I have (Filezilla & 7zip) work fine and aren't blocked - what the heck?

[Ted Pruitt]

So just to update - I excluded CLIENTSERVICE.EXE from McAfee's access protection - now when I push an install, it ends with this:

Log Name:      Application
Source:        SmartDeploy Console/Client Service
Date:          4/10/2019 10:52:03 AM
Event ID:      20005
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      PCSPI-Z240-2QGG.senatedem.local
Description:
Application Pack, Run Command Task: ZoomClient-x64-1.0.0.0.spk

Executable Location: C:\Windows\TEMP\SmartDeploy\Scratch\Application Manager\Zoom Client\Files\ZoomInstaller.exe
Arguments:
Return Value(s): -2
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SmartDeploy Console/Client Service" />
    <EventID Qualifiers="0">20005</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-10T15:52:03.212607200Z" />
    <EventRecordID>61180</EventRecordID>
    <Channel>Application</Channel>
    <Computer>PCSPI-Z240-2QGG.senatedem.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Application Pack, Run Command Task: ZoomClient-x64-1.0.0.0.spk

Executable Location: C:\Windows\TEMP\SmartDeploy\Scratch\Application Manager\Zoom Client\Files\ZoomInstaller.exe
Arguments:
Return Value(s): -2</Data>
  </EventData>
</Event>

[SmartDeploySupport]

Hi Ted, 

That return value doesn't look like a success - just to confirm, is the client installing properly now?

Glenn
SmartDeploy Support

[Ted Pruitt]

No - it doesn't install.

I've opened the smartdeploy\source and the windows\temp folders during a push - what I observe is that the SPK gets copied into smartdeploy\source, then it unpacks itself into the windows\temp\smartdeploy\etc... but there is no evidence that it runs and nothing in any log file. It's like it just gives up.

And I still think it's bizarre that your two packs work fine (that was before I disabled McAfee for the CLIENTSERVICE.EXE.)