Create own MSI Installer Verification of installation package failed (trac.defaults)

[m25487]

Hi there,

we have configured Remote Access VPN Client to disable the "always_connect" setting.
With the VPN Configuration Utility I integrate the trac.defaults file and thus create a new MSI installation file.
When importing the .msi file I get a "signature error" which I can skip, but at the latest during deployment I get a verification error.

When upgrading the client from E80.20 to E80.25, the trac.defaults file is overwritten and thus our "always_connect" (false) setting is lost.
Therefore I am forced to upload my own MSI file with integrated trac.defaults.

Is there a way to disable signature verification?
Or is there another way to include a separate trac.defaults file with an upgrade?
Or is there a possibility that the trac.defaults file will not be overwritten during a client upgrade.

Thanks.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[G_W_Albrecht]

sk172567: "Failed (Signature error)" message in SmartEndpoint, when the user fails to upload EPS.msi...

[PhoneBoy]

What version/JHF of management are we talking about?

[m25487]

R81.10 (81.10.9600.402)

[PhoneBoy]

Did you apply sk172567?
If that didn't work, it might be worth a TAC case.

[m25487]

Updated the Console to R81.10 (81.10.9600.404) same error message appears.
I will set up a fresh win 10 and install the console. I will report.

[m25487]

2 different Win 10 installations with the same problem.
Is there a possibility that the VPN Configuration Utility destroys the signature when creating the MSI file? According to the SK article, should the utility also work for Endpoint Security Client?

[PhoneBoy · Accepted solution]

Not as far as I know.
I recommend a TAC case.

[m25487]

OK. i opened a TAC case.

[G_W_Albrecht]

And what was the solution ?

[m25487]

Case ist still pending by checkpoint. I'll report as soon as I have more information

[m25487]

Reply from the TAC Support.

Customer: Hi there,
thanks for the enlightenment.
So that I understand correctly: Upgrading the client via the SmartEndpoint Console is only possible if the MSI file is downloaded directly from the Checkpoint server.
As I understand it correctly, the trac.defaults file is automatically overwritten when the client is upgraded. This is works as designed and cannot be prevented.

TAC Support: This is correct.

Regarding this statement: "As soon as the MSI file is changed/created, the client must be upgraded via SCCM/GPO." ---> Technically yes, we can dispatch this file to hosts separately but for large businesses SCCM/GPO are probably the most convenient and recommended.

As soon as the MSI file is changed/created, the client must be upgraded via SCCM/GPO.