MeerkatIT Posted July 28, 2017 ID:1147098 Share Posted July 28, 2017 I'm pushing out updates through the management console and 1 laptop is given me the following error: Installed successfully, but registration failed. The installation procedure has ended before the client registered. I've tried uninstalling it, rebooting, and reinstalling it both through the Management Console and manually with new package executable. The logs show the following error: 2017-07-28 9:03:11 AM Install client software: MsiExec.exe /i "C:\scclientinstall_90f34261_11de_4345_bb06_66a54f66fd04\ClientSetup.msi" /qn 2017-07-28 9:03:37 AM Enable MBAM exit code: 0 2017-07-28 9:03:37 AM Enable MBAE exit code: 2017-07-28 9:03:37 AM Sccomm installation exit code: 0 2017-07-28 9:03:37 AM After installation, check sccomm is installed. 2017-07-28 9:03:37 AM The sccomm is installed. 2017-07-28 9:03:37 AM The sccomm version: 1.7.0.3208 2017-07-28 9:03:37 AM Waiting for client registration. 2017-07-28 9:04:17 AM The client registration result: The installation procedure has ended before the client registered 2017-07-28 9:04:17 AM After installation, check coreclient is installed. 2017-07-28 9:04:17 AM The coreclient is installed. 2017-07-28 9:04:17 AM Get log from sccomm: C:\ProgramData\sccomm\sccomm.log 2017-07-28 9:04:17 AM File C:\ProgramData\sccomm\sccomm.log does not exist. It's only the one laptop affected the other 40 workstations installed fine. Any thoughts on how to fix? Link to post Share on other sites More sharing options...
djacobson Posted July 28, 2017 ID:1147208 Share Posted July 28, 2017 Hi @MeerkatIT, unfortunately, this message is not very meaningful, and your install should be fine. The client did not check back into the server within a set hardcoded timeframe. It could be because of firewall, network speed and another security product interfering with our communication. Let's see what's going on with it, use the tools below... Step A – Malwarebytes Client Log Set On the client go to C:\Program Files (x86)\Malwarebytes' Managed Client and run the tool CollectClientLog.exe. Attach the folder it generates. Step B – FRST Log In addition to the check logs, I would like to have you run a tool known as frst. frst will help provide me with a list of installed programs and other information about your computer that will help me see if there are any other problems that are not being detected. Please follow the steps below to run frst. 1.) Please download frst and frst64 from the link below and save it to your desktop: frst 32 Bitfrst 64 Bit Note: You need to download the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your computer; that will be the right version. Some traditional Anti-Viruses may false positive the download or running frst, I can assure you it is safe. If this happens, please temporarily disable the AV. 2.) Double-click the purple frst or frst64 icon to run the program. Click Yes when the disclaimer appears. 3.) Click the Scan button 4.) When the scan has finished, it will make 2 log files in the same directory the tool is located, frst.txt and Addition.txt. Please attach MBMC Client log, frst.txt and Addition.txt in your reply. Link to post Share on other sites More sharing options...
MeerkatIT Posted July 31, 2017 Author ID:1147983 Share Posted July 31, 2017 I attached the files. When I tried to Malwarebytes log i got the error "Could not fin a part of the path 'C:\programdata\sccomm\Logs. Addition.txt FRST.txt Link to post Share on other sites More sharing options...
djacobson Posted July 31, 2017 ID:1148033 Share Posted July 31, 2017 Thanks @MeerkatIT, for that message, try right clicking the client log tool and running it as admin. I'll check the frst in the meantime. Link to post Share on other sites More sharing options...
MeerkatIT Posted July 31, 2017 Author ID:1148040 Share Posted July 31, 2017 Here's the log. Sorry I should have tried it as an admin first. MBMC_Client_Diagnosis_Info_2017_07_31_110122.zip Link to post Share on other sites More sharing options...
djacobson Posted July 31, 2017 ID:1148065 Share Posted July 31, 2017 Hi @MeerkatIT, one of the logs in the client set I was expecting wasn't there. Could I have you manually check if C:\ProgramData\sccomm\Logs exists and if any sccomm text files are located there? Link to post Share on other sites More sharing options...
MeerkatIT Posted July 31, 2017 Author ID:1148078 Share Posted July 31, 2017 I checked the folder and it's empty. Link to post Share on other sites More sharing options...
djacobson Posted July 31, 2017 ID:1148081 Share Posted July 31, 2017 Thanks @MeerkatIT, I actually see in the frst log that the service is failing to run, there will be no sccomm log, and that is also why this machine failed to reg, the server client communicator is not running. The realtime engine service is also in a stopped state. R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [452576 2016-02-09] (Malwarebytes Corporation)S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [901088 2016-02-09] (Malwarebytes Corporation)S2 SCCommService; C:\Program Files (x86)\Malwarebytes' Managed Client\SCComm.exe [135680 2016-03-29] (Malwarebytes) [File not signed]R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-02-09] (Malwarebytes Corporation) Error: (07/28/2017 09:03:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The MEEClientService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. Error: (07/28/2017 09:03:36 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the MEEClientService service to connect. Try adding... C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Malwarebytes' Managed Client\SCComm.exe ...to be ignored by your SEP and Windows Defender, then try to start the MEEClientService and MBMAService in services.msc area. There are also a set of errors that suggests this machine has broken domain trust, you may wish to remove and re-add this machine to your domain. Error: (07/28/2017 09:01:51 AM) (Source: NETLOGON) (EventID: 5719) (User: ) Description: This computer was not able to set up a secure session with a domain controller in domain [REDACTED BY MALWAREBYTES] AGENT due to the following: We can't sign you in with this credential because your domain isn't available. Make sure your device is connected to your organization's network and try again. If you previously signed in on this device with another credential, you can sign in with that credential. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. Link to post Share on other sites More sharing options...
MeerkatIT Posted July 31, 2017 Author ID:1148099 Share Posted July 31, 2017 It appears the issues are quite a bit deeper than just Malwarebytes. I'm going to just wipe the laptop and give it a fresh install of everything. I've just been informed by the user that several programs don't work at all. Thank you for the help sorry for taking up your time. Link to post Share on other sites More sharing options...
djacobson Posted July 31, 2017 ID:1148101 Share Posted July 31, 2017 It's no problem at all! I'm happy I could've at least pointed you in the right direction! Link to post Share on other sites More sharing options...
Recommended Posts