Jump to content

Recommended Posts

I'm pushing out updates through the management console and 1 laptop is given me the following error:  Installed successfully, but registration failed.  The installation procedure has ended before the client registered.  I've tried uninstalling it, rebooting, and reinstalling it both through the Management Console and manually with new package executable.  The logs show the following error:

2017-07-28 9:03:11 AM    Install client software: MsiExec.exe /i "C:\scclientinstall_90f34261_11de_4345_bb06_66a54f66fd04\ClientSetup.msi" /qn
2017-07-28 9:03:37 AM    Enable MBAM exit code: 0
2017-07-28 9:03:37 AM    Enable MBAE exit code: 
2017-07-28 9:03:37 AM    Sccomm installation exit code: 0
2017-07-28 9:03:37 AM    After installation, check sccomm is installed.
2017-07-28 9:03:37 AM    The sccomm is installed.
2017-07-28 9:03:37 AM    The sccomm version: 1.7.0.3208
2017-07-28 9:03:37 AM    Waiting for client registration.
2017-07-28 9:04:17 AM    The client registration result: The installation procedure has ended before the client registered
2017-07-28 9:04:17 AM    After installation, check coreclient is installed.
2017-07-28 9:04:17 AM    The coreclient is installed.
2017-07-28 9:04:17 AM    Get log from sccomm: C:\ProgramData\sccomm\sccomm.log
2017-07-28 9:04:17 AM    File C:\ProgramData\sccomm\sccomm.log does not exist.

 

It's only the one laptop affected the other 40 workstations installed fine.  Any thoughts on how to fix?

Capture.JPG

Share this post


Link to post
Share on other sites

Hi @MeerkatIT, unfortunately, this message is not very meaningful, and your install should be fine. The client did not check back into the server within a set hardcoded timeframe. It could be because of firewall, network speed and another security product interfering with our communication. Let's see what's going on with it, use the tools below...

Step A – Malwarebytes Client Log Set
On the client go to C:\Program Files (x86)\Malwarebytes' Managed Client and run the tool CollectClientLog.exe. Attach the folder it generates.

Step B – FRST Log
In addition to the check logs, I would like to have you run a tool known as frst. frst will help provide me with a list of installed programs and other information about your computer that will help me see if there are any other problems that are not being detected. Please follow the steps below to run frst.

1.) Please download frst and frst64 from the link below and save it to your desktop:

frst 32 Bit
frst 64 Bit

Note: You need to download the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your computer; that will be the right version. Some traditional Anti-Viruses may false positive the download or running frst, I can assure you it is safe. If this happens, please temporarily disable the AV.

2.) Double-click the purple frst or frst64 icon to run the program. Click Yes when the disclaimer appears.
3.) Click the Scan button
4.) When the scan has finished, it will make 2 log files in the same directory the tool is located, frst.txt and Addition.txt.

Please attach MBMC Client log, frst.txt and Addition.txt in your reply.

 

Share this post


Link to post
Share on other sites

Hi @MeerkatIT, one of the logs in the client set I was expecting wasn't there. Could I have you manually check if C:\ProgramData\sccomm\Logs exists and if any sccomm text files are located there? 

Share this post


Link to post
Share on other sites

Thanks @MeerkatIT, I actually see in the frst log that the service is failing to run, there will be no sccomm log, and that is also why this machine failed to reg, the server client communicator is not running. The realtime engine service is also in a stopped state.

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [452576 2016-02-09] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [901088 2016-02-09] (Malwarebytes Corporation)
S2 SCCommService; C:\Program Files (x86)\Malwarebytes' Managed Client\SCComm.exe [135680 2016-03-29] (Malwarebytes) [File not signed]
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-02-09] (Malwarebytes Corporation)

Error: (07/28/2017 09:03:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The MEEClientService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

Error: (07/28/2017 09:03:36 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the MEEClientService service to connect.

 

Try adding...
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Managed Client\SCComm.exe
...to be ignored by your SEP and Windows Defender, then try to start the MEEClientService and MBMAService in services.msc area.

There are also a set of errors that suggests this machine has broken domain trust, you may wish to remove and re-add this machine to your domain.

Error: (07/28/2017 09:01:51 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: This computer was not able to set up a secure session with a domain
controller in domain [REDACTED BY MALWAREBYTES] AGENT due to the following: 
We can't sign you in with this credential because your domain isn't available. Make sure your device is connected to your organization's network and try again. If you previously signed in on this device with another credential, you can sign in with that credential.


This may lead to authentication problems. Make sure that this
computer is connected to the network. If the problem persists,
please contact your domain administrator.

Share this post


Link to post
Share on other sites

It appears the issues are quite a bit deeper than just Malwarebytes.  I'm going to just wipe the laptop and give it a fresh install of everything.  I've just been informed by the user that several programs don't work at all. Thank you for the help sorry for taking up your time.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.