Elastic Agent ErrorDetails="exit status 1"on Windows Server

[SigWar]

I'm currently running a Security Onion Standalone instance on version 2.4.50 and I am trying to deploy the elastic agent to a Windows Server in an airgap environment. I modified the firewall rules to include the subnet of the server, as suggested in the documentation. I am receiving the following error in my elastic agent host log:

**timestamp=2024-03-06T17:13:41.0511083-05:00 level=info message="Version Information" ElasticAgentVersion=8.7.0 WrapperVersion=2.4.2

timestamp=2024-03-06T17:13:41.05211-05:00 level=info message="Runtime Data" EnrollmentToken="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==" FleetURL/s=https://XXXXXXXXXX:8220

timestamp=2024-03-06T17:13:41.05211-05:00 level=info message="Installation Progress" Status="Starting Installation Precheck"

timestamp=2024-03-06T17:13:41.1127532-05:00 level=info message="Installation Progress" FleetHostConnectivityCheck=Success FleetHostURL=https://XXXXXXXXXXXXX:8220

timestamp=2024-03-06T17:13:41.1289261-05:00 level=info message="Installation Progress" Status="Fleet Host is accessible - Continuing installation"

timestamp=2024-03-06T17:13:41.1289261-05:00 level=info message="Installation Progress" Status="Installation Precheck Complete"

timestamp=2024-03-06T17:13:41.1289261-05:00 level=info message="Installation Progress" Status="Extracting Elastic Agent files"

timestamp=2024-03-06T17:15:30.5530446-05:00 level=info message="Installation Progress" Status="Executing Elastic Agent installer"

timestamp=2024-03-06T17:15:30.5530446-05:00 level=info message="Installation Progress" Status="Executing the following: ./so-elastic-agent_source/elastic-agent/elastic-agent install --url=https://XXXXXX:8220 --enrollment-token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX== --certificate-authorities=C:\Program Files\Elastic\SO\soca.crt -n"

timestamp=2024-03-06T17:18:30.5801211-05:00 level=error message="Installation Progress" Context="Installing in non-interactive mode." ErrorDetails="exit status 1"**

After this installation failed, I installed the soca.crt certificate to the local machine and still no luck....

Any help would be much appreciated...

[cm-ops]

Did you use the Windows agent installer from SOC > Downloads?

[SigWar]

Yes, I am. There is an update on my issue though - I was able to successfully run and pull in an agent with the Linux installer. I'm starting to lean on it being a self-signed certificate issues with the Windows Server....
On the Windows Server machine, I have to run the executable through cmd/powershell as admin. When I try to run the executable normally as admin (right-click the executable, run as admin...) an error was thrown with "a referral was returned from the server". I've tried to check on the recommended UAC settings - I have the correct permissions (running as a domain admin)... still testing a few things, but any extra advice would be helpful.

[cm-ops]

You might be running into a timeout, if the installer does not finish within 3 minutes, it times out. One possible reason is it could be taking that long because of high resource contention on the Windows Server. We did create an issue for vetter timeout error messaging #12534

[defensivedepth]

@SigWar

2.4.70 was released yesterday and it changes the default timeout to 5 minutes, as well as adds a command line parameter timeout that can be used to override the default.