Environment
ZENworks Configuration Management 2017 Installation - Agent
Situation
After updating the ZAA to ZENworks 2017 Update1
ZIcon > Technician Application > Agent > Agent Status (components)
FDE component is missing in the list after updated to ZENworks 2017 Update1
System-update.log
[ERROR] [07-31-2017 10:21:29.270] [4544] [ZENUpdater] [] [Système] [SystemUpdate] [MSI_INSTALL_ERROR] [ERROR] [novell-zenworks-fde-api-17.1.0.106.x86_64.msi,1603] [] [] [ZENworks]
[DEBUG] [07-31-2017 10:21:29.285] [4544] [ZENUpdater] [] [Système] [SystemUpdate] [] [DEBUG] [Control MSI failed to install, installation of the dependent MSIs have been skipped.] [] [] [ZENworks]
novell-zenworks-fde-api-17.1.0.106.x86_64.msi.log - Error 1722
MSI (s) (8C:08) [10:21:29:161]: Note: 1: 1722 2: CallFDEPrerequisiteCheckerAtInstall 3: C:\Windows\TEMP\{F370FDCB-67F4-4B7B-9430-6E774F16BF35}\ 4: "C:\Windows\TEMP\{F370FDCB-67F4-4B7B-9430-6E774F16BF35}\\FdePrequisiteChecker.exe" -in "C:\Program Files (x86)\Novell\ZENworks\cache\zmd\ZenCache\067aafee-d703-41f6-b20d-517bb4cc756b\dmi.ini"
CustomAction CallFDEPrerequisiteCheckerAtInstall returned actual error code -928
ZIcon > Technician Application > Agent > Agent Status (components)
FDE component is missing in the list after updated to ZENworks 2017 Update1
System-update.log
[ERROR] [07-31-2017 10:21:29.270] [4544] [ZENUpdater] [] [Système] [SystemUpdate] [MSI_INSTALL_ERROR] [ERROR] [novell-zenworks-fde-api-17.1.0.106.x86_64.msi,1603] [] [] [ZENworks]
[DEBUG] [07-31-2017 10:21:29.285] [4544] [ZENUpdater] [] [Système] [SystemUpdate] [] [DEBUG] [Control MSI failed to install, installation of the dependent MSIs have been skipped.] [] [] [ZENworks]
novell-zenworks-fde-api-17.1.0.106.x86_64.msi.log - Error 1722
MSI (s) (8C:08) [10:21:29:161]: Note: 1: 1722 2: CallFDEPrerequisiteCheckerAtInstall 3: C:\Windows\TEMP\{F370FDCB-67F4-4B7B-9430-6E774F16BF35}\ 4: "C:\Windows\TEMP\{F370FDCB-67F4-4B7B-9430-6E774F16BF35}\\FdePrequisiteChecker.exe" -in "C:\Program Files (x86)\Novell\ZENworks\cache\zmd\ZenCache\067aafee-d703-41f6-b20d-517bb4cc756b\dmi.ini"
CustomAction CallFDEPrerequisiteCheckerAtInstall returned actual error code -928
Resolution
See the Update process in the documentation
ZENworks 2017 Update 1 - Full Disk Encryption Update Reference
Remove the older FDE Policy first and wait for system to decrypt drive
Then apply the ZENworks 2017 Update1 Agent
Then apply new ZENworks 2017 Update1 Policy to device
System should Encrypt properly with the latest agent and latest FDE policy.
ZENworks 2017 Update 1 - Full Disk Encryption Update Reference
Remove the older FDE Policy first and wait for system to decrypt drive
Then apply the ZENworks 2017 Update1 Agent
Then apply new ZENworks 2017 Update1 Policy to device
System should Encrypt properly with the latest agent and latest FDE policy.
Cause
Older FDE policies were enforced (non-2017 Update1) on the managed
device prior to ZAA upgrade to ZENworks 2017 Update1
There are a "group" of MSIs related to FDE and the first one checks if FDE is enforcing a policy.
If that's the case, then ZAA system update skips the FDE upgrades (it fails the first one and skips that "group" and goes on to the rest of the SU)
There are a "group" of MSIs related to FDE and the first one checks if FDE is enforcing a policy.
If that's the case, then ZAA system update skips the FDE upgrades (it fails the first one and skips that "group" and goes on to the rest of the SU)
Additional Information
See Bug 1056200
To check if drive is encrypted run C:\Windows\NAC\nbstatus.exe
Use USB or CD with ERI to decrypt drive
Working as designed
Documented in
What's New in ZENworks 2017 Update1 - Full Disk Encryption
ZENworks 2017 Update1 - Full Disk Encryption Update Reference
SYSINFO.NFO will show # of disk partitions
May have to remove the agent and reinstall.
To check if drive is encrypted run C:\Windows\NAC\nbstatus.exe
Use USB or CD with ERI to decrypt drive
Working as designed
Documented in
What's New in ZENworks 2017 Update1 - Full Disk Encryption
ZENworks 2017 Update1 - Full Disk Encryption Update Reference
SYSINFO.NFO will show # of disk partitions
May have to remove the agent and reinstall.