Environment
- Carbon Black Cloud Sensor (formerly CB Defense): All Versions
- Microsoft Windows: All Supported Versions
- SCCM configured and managing clients
- Carbon Black Cloud Sensor (formerly CB Defense) was previously deployed and successfully uninstalled
Symptoms
- Install of Carbon Black Cloud Sensor fails
- This error may show in verbose MSI log (/L*vx)
CA:InstallPreCheck: Error 0x8000ffff: Expect a cfg.ini in the same directory as the MSI, but cound not find it.
- Old Sensor Versions may be referenced in verbose MSI log
- Entries in verbose MSI log may reference ccmcache as installer source
MSI (s) (XX:XX) [XX:XX:XX:XXX]: SOURCEMGMT: Trying source C:\Windows\ccmcache\
Cause
If SCCM was not configured
to allow upgrades, SCCM will create registry keys on the client that will prevent installation of new CB Defense versions.
Resolution
- Backup registry prior to edits
- Locate the following registry key
HKEY_CLASSES_ROOT\Installer\Products\{CB Defense GUID}
- Delete the registry key
- Perform install as usual to resolve issue
- Check SCCM configuration to ensure ability to allow upgrades
Additional Notes
- The {CB Defense GUID} is a string of characters randomly generated for each new sensor install. This is different from the MSI GUID. The value can be found via an elevated command prompt
reg query HKEY_CLASSES_ROOT\Installer\Products\ /s /f "Cb Defense Sensor"
- For newer sensors (3.5 and higher)
reg query HKEY_CLASSES_ROOT\Installer\Products\ /s /f "Carbon Black Cloud Sensor"
- It may be necessary to review all entries in HKEY_CLASSES_ROOT\Installer\Products\ to ensure there are not multiple entries for Carbon Black Cloud/Cb Defense
- This issue can happen if SCCM Configuration Manager is configured with detection rule: "This MSI product code must exist on the target system to indicate the presence of this application"
- This issue will occur on any machines with this registry key in place, even if Carbon Black Cloud/Cb Defense has been uninstalled
Related Content
