000036751 - Upgrade or Install of RSA NetWitness Endpoint agent fails with system error code 258 in install log

Document created by RSA Customer Support Employee on Sep 24, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000036751
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.x, 4.3.x
Platform: Windows
IssueNetWitness Endpoint agent will fail to upgrade as seen in log files such as the NWE install log, and the version reported in the UI.
  • A successful install log output:
    • Doing action: OnSuccessExitAction
  • A failing install log output:
    • Failed to grab execution mutex. System error 258.
CauseThis is normally caused by either:
  1. A running instance of the msi installer that is currently executing already. This will prevent further installs until the first is complete when running an msi installer.
  2. PendingFileRenameOperations registry key is present. This regkey is meant to prevent msi installs until the system has been rebooted, so pending changes to the system can be performed before updating additional files.
See the link here for more details on the regkey mentioned above
ResolutionTo determine if there are any pending files awaiting reboot, run regedit and check the following regkey:
  • HKLM\SYSTEM\CurrentControlSet\Control\Session Manager "PendingFileRenameOperations"
If the key is populated and shows entries, the next step would be to reboot the system to apply pending file rename changes. If it still shows this key populated after reboot, it may be necessary to delete the key instead but caution should be taken in deleting this key to avoid stability issues.

If the issue is related to the msi install awaiting completion of another install, verify the pending process completes before attempting to upgrade the agent again. This can be done with Task Manager to check for running msi installers in the background.