Error 4120. There was an error during the Windows Firewall configuration process.

[amarnathchandran]

Dear Advanced Installer Support Team,

Two of our customers is complaining that our installer reported an error while they tried to upgrade our product on Windows machines. They sent an installation log file for us. Apparently one of your custom actions are failing:

MSI (s) (8C!40) [11:42:39:451]: Product: cwClient -- Error 4120. There was an error during the Windows Firewall configuration process.
Your original Firewall configuration will be restored.

Error 4120. There was an error during the Windows Firewall configuration process.
Your original Firewall configuration will be restored.
CustomAction AI_FwConfig returned an actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Could you please help us identify the source of the problem? Thanks in advance! We have to answer something for our customer as soon as possible.

Thanks,
Amarnath

[Daniel]

Hello Amarnath,

We further investigated and tested your product setup but we were not able to replicate such error.

Could you please instruct your customers to run your setup package with the following command line:

Code: Select all

Setup.exe AI_DEBUGLOG=1 /L*V log.txt

and then send us the log.txt file too?

All the best,
Daniel

[digocesar]

I'm having this problem too.
Attached is my log file.

[Catalin]

Hello,

From the log file, it seems that the setup fails to enable the "UPnP service". Could you please go to "Windows Firewall" page --> "Options" tab --> select "Leave unchanged" for the "UPnP service" and let me know if that helps?

Additionally, do you run your setup with elevated privileges?

If that helps, then please forward me a download link for your setup and also the .AIP file used to build the setup by e-mail at support at advancedinstaller dot com so I can further investigate this.

Best regards,
Catalin

[digocesar]

Running with elevated privilege doesn't work.
Disabling windows firewall service doesn't work too.
Machine has no antivirus software.

I saw that the problem was enabling "UPnP service" and the only solution was to change this option to "Leave unchanged".
This issue happens only in two of my customers and I can't leave this option as "Leave unchanged" to all customers.

Even if I pass my project to you is very likely that you will not be able reproduce it.

I don't have access to the problematic machine anymore.
Is there another test I can do if it happens on another customer?

[Catalin]

Hello,

Is there another test I can do if it happens on another customer?

If this happens again, please follow the next steps (in order to try and manually enable the UPnP service):

1. go to Start and open Control Panel

2. open System and Security > Windows Defender Firewall > Advanced Settings

3. select "Inbound Rules" and try to Enable the "Network Discovery (UPnP-in)" rule for the Private profile

Hope this helps somehow.

Best regards,
Catalin

[ryssel]

Hi
We are having the same problem on some of our customers PC's.
It makes it even worse that if you are updating to a newer version of our software the it successfully uninstalls the existing installation but fails to install a new version so the customer ends up without our software, we can't even install the old version again.
I tried to Enable "Inbound Rules" "Network Discovery (UPnP-in)" for all profiles (Public and Private) but it didn’t help anything.
/Lars

[digocesar]

I had other customer with same error.
I had tried to activate UPnP inbound in firewall but it does not resolved the problem.
Attached there is log from this machine.

[Catalin]

Hello guys,

First of all, please accept my apologies for the delayed reply.

Attached you can find a link to a debug DLL which hopefully will give me some more details about what is happening during the installation process than the normal log:

https://drive.google.com/open?id=1r8P8G ... tgauX_7mCu

Please download it and replace the one from the following location:

e.g.: C:\Program Files (x86)\Caphyon\Advanced Installer <version>\custact\x86

with the one downloaded.

After doing so, please rebuild the project and run the installation once again with the following command line:

Code: Select all

msiexec.exe /i "D:\Sample.msi" AI_DEBUGLOG=1 /L*V "D:\example.log"

if the package is an MSI and:

Code: Select all

"D:\Sample.exe" AI_DEBUGLOG=1 /L*V "D:\example.log"

if the package is an EXE.

Please forward me the log file after doing so I can try to further investigate this.

I had tried to activate UPnP inbound in firewall but it does not resolved the problem.

and

I tried to Enable "Inbound Rules" "Network Discovery (UPnP-in)" for all profiles (Public and Private) but it didn’t help anything.

Did it work to manually activate the UPnP rule?

Looking forward to hearing from you.

Best regards,
Catalin

[digocesar]

Hi Catalin.
Manually activating the UPnP option on Windows Firewall settings the UPnP is activated but it does not solves the installer problem.
Next custumer with this problem I will try you dll.
Best regards,
Rodrigo Cesar

[Catalin]

Hello Rodrigo,

Lars, who was also encountering the same issue, have sent me the log using the debug .DLL. Unfortunately, that didn't prove to be of much help. Of course, you can send the log to me and I will see what I can find.

This seems to be an issue in what regards the "Enable UPnP service" option. However, I can not say for sure why this happens since we were never able to reproduce this issue on our end.

However, since you said that you were able to manually activate it, it is most probably a problem within the implementation (I can still not know for sure, this is just a wild guess).

In this case, as a workaround, I was thinking that maybe you can replace our predefined support with a custom action. For instance, a script (e.g. PowerShell, VBS) which can enable that service.

By default, I could notice that the above mentioned option is enabled during the "Add resources" action group - between the "Install Services" and "Start Services" standard actions. You can schedule your custom action between the two standard actions.

In order to display a standard action in the installation sequence ("Custom Actions" page), you can right click on any action group (from the "Install Execution Stage") --> "Show Standard Action" --> "Add resources" --> select the standard action that you want to be displayed in the sequence. After doing so, simply drag the custom action between the two standard actions.

Hope this helps.

Best regards,
Catalin

[ryssel]

Hello Catalin
We are still seeing new customers with this problem.
We are using UPnP and has this option checked in Advanced Installer for more than nine years, I'm afraid to replace it with some VBS not doing exactly the same.
Can you please tell me exactly what actions Advanced Installer is trying to perform when "Enable UPnP service" is checked, and how to do the same in VBS.
Best regards
Lars Ryssel

[Catalin]

Hello Lars,

Can you please tell me exactly what actions Advanced Installer is trying to perform when "Enable UPnP service" is checked

Sure. In a newly created project (dummy project), if you go to "Windows Firewall" page --> "Options" page and enable any of the options there, the following action is added in the "Table Editor" page --> "Install Execute Sequence" table:

AI_FwInstall

If you order the actions by their sequence, you can notice that this custom action is scheduled during the deferred action stage (when the system is being modified) and between the "InstallServices" and "StartServices" actions.

As discussed above, by manually enabling that option in the "Windows Firewall" page, all that happens is that the "Network Discovery (UPnP-In)" inbound rule is enabled for the Private profile.

Basically, what we need to do here is to enable that inbound rule for the Private profile.

and how to do the same in VBS

Unfortunately, I am not very experienced in what regards VBS. I can, however, help you with a little PowerShell script which does just that:

Code: Select all

Get-NetFirewallRule | Where {$_.DisplayName -eq "Network Discovery (UPnP-In)" -and $_.Profile -like "*Private*"} | Enable-NetFirewallRule

The above PowerShell script will enable the inbound rule we've previously discussed.

Here is how you can implement that in Advanced Installer:

1. first, you need to disable the option from the "Windows Firewall" page

2. now please go to "Custom Actions" page and add a "Run PowerShell inline script" custom action, with sequence (simply press the "Add custom action with sequence" button which is placed to the right side of the custom action's name).

3. copy paste the code from above. Additionally, set the execution time to "When the system is being modified (deferred)" and also check the "Run under the LocalSystem account with full privileges (no impersonation)" option. Optionally, you can set this action to execute only during Install by unchecking the "Uninstall" and "Maintenance" options from under the "Execution Stage Condition" section.

4. now please right click on any action group from the "Install Execution Stage" --> "Show Standard Action" --> "Add Resources" --> select "InstallServices"

5. please repeat the above step, but now select the "StartServices" action

6. now please schedule your custom action between the two actions mentioned above. To do so, simply drag and drop it.

7. in the end, your custom action should look something similar to this.

PS.png (163.2 KiB) Viewed 21297 times

Hope this helps.

Best regards,
Catalin

[chrisdk781]

Hello.

I found that we also experience this issue with the 4120 error when we run the setup in maintenance mode Advanced Installer version 17.

I used the log option to find out where exactly the installer would encounter this error.

Code: Select all

Setup.exe AI_DEBUGLOG=1 /L*V log.txt

Here is the example from my log.

Code: Select all

OnFwConfig: ConfigureFwOption start.
OnFwConfig: FW Rule: AllowInboundEchoRequest
AI_FwConfig: Configuring Windows Firewall rule: "AllowInboundEchoRequest"
OnFwConfig: Initializing Profiles: [ 0 ]...
OnFwConfig: INetFwPolicy2: CurrentProfileType = PRIVATE
OnFwConfig: C:\JobRelease\custact\NetFirewall\src\NetFirewallMgrImpl.cpp:126 -> ERROR: 4120

As you can see if fails trying to set my allow inbound echo request. Note: I know this is not always good to enable however our techs rely on it for troubleshooting.

I tried the example given by Catalin however this does not correct the issue.

So by chance I have some custom C sharp applications that set firewall settings and instead of relying on them in the installer I ran them over and over to determine why this would cause a problem. What I discovered is that when a firewall setting already exists and you try to set it again you run into an exception. I am curious if this is the issue in the C++ code that is being ran in your NetFirewallMgrImpl.cpp line 126.

A good way to try would be setup a dummy project and enable firewall exceptions and the echo request and run it which should set the rules.
Then Run it again and see if it errors trying to set them again or run it in repair mode which should attempt to set the rules and fail.

Hopefully this helps to recreate the issue.

In the meantime what I found works is if I run my setup.exe and all the rules I expect to be setup are and I need to run a repair.
I manually removed the rules and ran the repair and it ran with no issues.

I plan to just write a custom action that will remove the rules as soon as you click repair and this should resolve my 4120 issue.
EDIT Forgot to mention I was testing on the latest release of windows 10 completely upgraded and no pending updates to install.
Chris.

[Eusebiu]

Hi Chris,

Can you try to set the "(Not Installed)" condition for the firewall rules from your project and see if it helps? In this case, the installer will try to set the rule only on during the installation.

Best regards,
Eusebiu