Failed to stop Harmony SASE when upgrading from 12.1.0.9079 to 12.4.0.10709

[RayP]

Hi all,

We're using Microsoft Intune for App deployment of Harmony SASE 12.4.0.10709 to our endpoints.

All our endpoints are Windows 11 (10.0.26100.7623)

Users are using the same profile within Harmony SASE.

The command we're using for Transparent Interne Access Installation is:

msiexec /quiet /i "Harmony_SASE_12.4.0.10709.msi" REGION="EU" TENANT_TOKEN="********"

A lot of devices (about 15%)  shows the following:

CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
(CustomActions.dll)INFO: PollDriverFlags: Perimeter81Netfilter2 polled flag value is 0x1
MSI (s) (0C!D0) [09:27:13:425]: Product: Harmony SASE -- Failed to stop Harmony SASE. Please retry later.

Failed to stop Harmony SASE. Please retry later.
CustomAction CheckNetfilterDriverUnloadable returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 09:27:13: CheckNetfilterDriverUnloadable. Return value 3.
Action ended 09:27:13: INSTALL. Return value 3.
MSI (s) (0C:C4) [09:27:13:425]: Product: Harmony SASE -- Installation failed.

It looks like the installations command can't stop the services of Harmony SASE.

All the devices with this behaviour of not being able to upgrade have Harmony SASE 12.1.0.9079 installed. 

[the_rock]

I have harmony sase lab, can check on this tomorrow morning. Not using intune myself, but happy to have a look.

[RayP]

Thnx Andy, please let me know.

[the_rock]

Of course, no worries. I will test it in a bit.

[the_rock]

Just tested it, no issues for me.

[RayP]

Did you test with an upgrade or a new installation of the harmony sase client?

[the_rock]

Upgrade method.

[the_rock]

Hey @RayP 

Any luck with this?

If not, I definitely suggest opening P81 case for it.

https://help.perimeter81.com/support/home

[bleyers]

Have the same  issue ...
Also Intune

After some searching i found this page
https://support.perimeter81.com/docs/windows-agent-release-notes

Windows agent 12.5.0.11894 (Beta)

February 9th, 2026

Resolved Issues:

• P81-100329 – Agent uninstall using management tools triggers the anti-tampering mechanism

[the_rock]

I would open P81 case for it.

[RayP · Accepted solution]

We solved it by using a pre-script:

Start-Transcript -Path "C:\DeployLogs\StopSASE-Service.log"
Write-Host '******************************'

# Script to stop the Perimeter81 services before an update is started (the update failes sometimes because it fails to stop the Service).

# Check if the "Perimeter81.Service" Service exists
$chkperi = Get-Service -Name "Perimeter81.Service" -ErrorAction Ignore
If($chkperi -ne $null) {
Write-Host 'Changing the Recovery options of the "Perimeter81.Service" Service'
Write-Host '******************************'
cmd /c 'sc.exe failure "Perimeter81.Service" reset=0 actions= ""'
Write-Host 'Stopping the "Perimeter81.Service" Service'
$getPIDserv = (Get-Process | Where-Object { $_.Name -like "*Perimeter81.se*" }).Id
Stop-Process -Id $getPIDserv -Force
Write-Host '******************************'
}
Else {
Write-Host 'The "Perimeter81.Service" Service was not found, nothing to do.'
Write-Host '******************************'
}

# Check if the "Perimeter81.HelperService" Service exists
$chkperihelp = Get-Service -Name "Perimeter81.HelperService" -ErrorAction Ignore
If($chkperihelp -ne $null) {
Write-Host 'Stopping the "Perimeter81.HelperService" Service'
$getPIDhelp = (Get-Process | Where-Object { $_.Name -like "*Perimeter81.help*" }).Id
Stop-Process -Id $getPIDhelp -Force
}
Else {
Write-Host 'The "Perimeter81.HelperService" Service was not found, nothing to do.'
}

Stop-Transcript

[the_rock]

Excellent, thanks for letting us know!