topic Re: Create own MSI Installer Verification of installation package failed (trac.defaults) in Endpoint

Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Wed, 23 Mar 2022 13:17:03 GMT

Hi there,

we have configured Remote Access VPN Client to disable the "always_connect" setting.
With the VPN Configuration Utility I integrate the trac.defaults file and thus create a new MSI installation file.
When importing the .msi file I get a "signature error" which I can skip, but at the latest during deployment I get a verification error.

When upgrading the client from E80.20 to E80.25, the trac.defaults file is overwritten and thus our "always_connect" (false) setting is lost.
Therefore I am forced to upload my own MSI file with integrated trac.defaults.

Is there a way to disable signature verification?
Or is there another way to include a separate trac.defaults file with an upgrade?
Or is there a possibility that the trac.defaults file will not be overwritten during a client upgrade.

Thanks.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122574

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108982&partition=Advanced&product=Endpoint

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

G_W_Albrecht — Wed, 23 Mar 2022 14:35:53 GMT

sk172567: "Failed (Signature error)" message in SmartEndpoint, when the user fails to upload EPS.msi packages

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

PhoneBoy — Wed, 23 Mar 2022 14:39:16 GMT

What version/JHF of management are we talking about?

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Wed, 23 Mar 2022 15:06:04 GMT

R81.10 (81.10.9600.402)

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

PhoneBoy — Wed, 23 Mar 2022 15:28:52 GMT

Did you apply sk172567?
If that didn't work, it might be worth a TAC case.

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Wed, 23 Mar 2022 15:35:10 GMT

Updated the Console to R81.10 (81.10.9600.404) same error message appears.
I will set up a fresh win 10 and install the console. I will report.

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Thu, 24 Mar 2022 09:42:28 GMT

2 different Win 10 installations with the same problem.
Is there a possibility that the VPN Configuration Utility destroys the signature when creating the MSI file? According to the SK article, should the utility also work for Endpoint Security Client?

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

PhoneBoy — Thu, 24 Mar 2022 15:08:29 GMT

Not as far as I know.
I recommend a TAC case.

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Thu, 24 Mar 2022 15:29:20 GMT

OK. i opened a TAC case.

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

G_W_Albrecht — Thu, 31 Mar 2022 14:00:58 GMT

And what was the solution ?

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Thu, 31 Mar 2022 14:19:20 GMT

Case ist still pending by checkpoint. I'll report as soon as I have more information

Re: Create own MSI Installer Verification of installation package failed (trac.defaults)

m25487 — Wed, 13 Apr 2022 07:51:52 GMT

Reply from the TAC Support.

Customer: Hi there,
thanks for the enlightenment.
So that I understand correctly: Upgrading the client via the SmartEndpoint Console is only possible if the MSI file is downloaded directly from the Checkpoint server.
As I understand it correctly, the trac.defaults file is automatically overwritten when the client is upgraded. This is works as designed and cannot be prevented.

TAC Support: This is correct.

Regarding this statement: "As soon as the MSI file is changed/created, the client must be upgraded via SCCM/GPO." ---> Technically yes, we can dispatch this file to hosts separately but for large businesses SCCM/GPO are probably the most convenient and recommended.

As soon as the MSI file is changed/created, the client must be upgraded via SCCM/GPO.