I'm trying to install a sandblast endpoint, but I get this warning message. What should I do?

[Beomseok_Jang]

I'm trying to install a sandblast endpoint, but I get this warning message. What should I do?

message : Check Point Endpoint Security requires Administrator privileges. Log on as an administrator and then retry this installation.

[Kim_Moberg]

Hi

I had the same issue.

Run cmd-prompt as administrator.

Navigate to the folder of the installation file

Enter msiexec /i epm.msi

Or just Enter the file name epm.msi

Then it will install

Best regards

Kim

[Happy__]

SK108354 

msiexec /i "DRIVE:\path_to_EPS.msi_file\EPS.msi" /l*v C:\EPS_install.log

[Shahar_Grober]

Does anybody knows what is the cause of this issue?

I am trying to install it on a laptop with Domain admin rights and still get this error 

[Steve_Lander]

Try logging in as local admin if installing manually, or if using software deployment, have it installed under local system.

[Shahar_Grober]

Just found out from Check Point support that it is not possible to install it by double clicking on the package. Which is bad if you want to test it manually. The only way is to use msiexec or as Steve mentioned to use software deployment (GPO,SCCM)

[Tom_Kendrick]

Hi Shahar, that's incorrect - it is possible to install EPS.msi files manually, just by running the file as an admin. 

You can do this using Start -> run -> cmd, then do a run as Administrator.

From there, find the folder where the EPS.msi is located, and then type eps.msi and it will install fine.

[Chris_Butler]

I am getting the same error when trying to install on Windows Server 2019 running as a VM on a Windows server 2019 Hyper-V host.  confirmed to happen on OS build 1809

The problem happens on a brand new HP Z2 G4 Workstation running the OEM installation of Windows 10, updated to build 1903.

This also happens on our older Windows 7 Professional 64 bit machines.

The user in question has full admin rights to the local machines in all cases.

This happens for endpoint client MSI packages that have any kind of payload of blades.

it does  NOT happen with the initial Client MSI.

NOTE: In ALL test cases above, the machines are Domain Joined.

I never noticed this until just recently while testing the Hyper-V VM Bootlooping/Checkpoint Antimalware issue covered in one of my other posts.  Working with R&D they provided me with a build with all blades that uses the A2 Anti Malware engine that fixes the boot looping VM issue, but they did not give me an initial client from that build as well at that point in the testing, so I decided to export an MSI with all the blades I needed to test.

Up until that point I always deployed only the initial client to new PCs and let the management server deployment policy handle installing the desired set of blades. So this was the first time I saw this happening.

As a result, I am not sure how long this issue may have existed.

Any other MSI installers from any other manufacturers interact properly with UAC and install without a problem if the user in question is a domain admin or explicitly a member of the local (built-in) Administrators group on the machine in question.

I have tested with the machines in an Active Directory OU with group policy inheritance blocked and NO GPOs applied, all default local group policy and the issue happens too.

If you launch the MSI from a non-elevated command prompt, you get the error as well.

If you launch from an elevated command prompt, the installer runs.

I am working with someone from R&D now and providing a testing environment, as in their testing lab, they can't seem to replicate the problem.

I will let you all know if there is anything to report, otherwise, for all I know this might have been expected behavior all this time.

Chris

[rzwarts]

Did any solution come back from R&D ? We need to deploy EPS as well without admin rights. Local System user will not work. So any hints ? 

[_Val_]

Considering the depth of EPS integration, it is very unlikely to install it without admin permissions. What's wrong with using AD admin to do that?

[rzwarts]

AD admin? Can you be more precise? And we're actually using Endpoint VPN. So not EPS.