Win 2008 - MSI installer fails with firewall exception

Question

OS: Windows 2008 R2
Zabbix Agent 2 - 6.2.5

As admin, when installing Zabbix Agent 2 MSI package with a PowerShell script, I'm getting what seems to be a firewall exception. That causes MSI installer to rollback. The MSI installation log displays some errors related to Windows Firewall.

My PS script uses these parameters:

$argList = @('/norestart',
            '/qn',
            '/passive',
            '/l*v',
            "$zabbixDir\zabbixInstall.log",
            '/i',
            "$dirTemp\$msiAgentZabbix",
            "INSTALLFOLDER=$zabbixDir",
            "LOGFILE=$zabbixDir\zabbixAgent.log",
            "SERVER=$proxy",
            "SERVERACTIVE=$proxy",
            "HOSTNAME=$hostname",
            "ENABLEPERSISTENTBUFFER=1",
            "PERSISTENTBUFFERPERIOD=1d",
            "PERSISTENTBUFFERFILE=$zabbixDir\zabbixAgent.db",
            "ALLOWDENYKEY=AllowKey=system.run[*]",
            "HOSTMETADATA=`"windows $proxyname $metadata`"")
Start-Process msiexec.exe -Wait -PassThru -ArgumentList "$argList"

I've never had an issue with the MSI installer on Win 2008 VMs, but now, with other similar VMs, I'm getting these error messages.

MSI installation Log:

MSI (s) (18:F8) [09:57:32:457]: Doing action: WixSchedFirewallExceptionsUninstall
Action ended 9:57:32: RemoveEnvironmentStrings. Return value 1.
MSI (s) (18:40) [09:57:32:457]: Invoking remote custom action. DLL: C:\Windows\Installer\MSIC223.tmp, Entrypoint: SchedFirewallExceptionsUninstall
MSI (s) (18:34) [09:57:32:457]: Generating random cookie.
MSI (s) (18:34) [09:57:32:517]: Created Custom Action Server with PID 8076 (0x1F8C).
MSI (s) (18:C8) [09:57:32:777]: Running as a service.
MSI (s) (18:C8) [09:57:32:777]: Hello, I'm your 32bit Impersonated custom action server.
Action start 9:57:32: WixSchedFirewallExceptionsUninstall.
SchedFirewallExceptions:  Component 'CONFIGFWx64' action state (1) doesn't match request (2)
SchedFirewallExceptions:  No firewall exceptions scheduled
MSI (s) (18:F8) [09:57:32:787]: Doing action: RemoveFiles
Action ended 9:57:32: WixSchedFirewallExceptionsUninstall. Return value 1.

(...)

ExecFirewallExceptions:  Installing firewall exception2 Zabbix Agent 2 listen port on port , protocol 6
ExecFirewallExceptions:  Error 0x800706d9: failed trying to find existing port rule
ExecFirewallExceptions:  Error 0x800706d9: failed to add/update port exception for name 'Zabbix Agent 2 listen port' on port , protocol 6
CustomAction WixExecFirewallExceptionsInstall returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
MSI (s) (F4:54) [08:00:09:652]: User policy value 'DisableRollback' is 0
MSI (s) (F4:54) [08:00:09:652]: Machine policy value 'DisableRollback' is 0
Action ended 8:00:09: InstallFinalize. Return value 3.

The oddest thing is that Windows Firewall is disabled on all VMs. So, I can't see why that would be an issue for MSI installer.

If I start the MSI installer manually using its GUI, the installation works fine.

I'm not really sure the issue is the firewall, but that was all I could find.

Any idea?

Answer 1

Thank you all for your considerations.

Windows Firewall service was disabled on some hosts. To bypass the issue, I enabled the service while maintaining the Firewall turned off.

After doing so, the installation was successful.

What still bothers me, is that, if installing with the traditional GUI, there were no issues. Only when installing with PS script it failed.

For now, by checking the Firewall service, I can use the MSI package with the script.