IBM Support

WinCollect 10: Installation or upgrade displays "WinCollect 10 Setup Wizard ended prematurely" error

Troubleshooting


Problem

Administrators who attempt to install WinCollect 10.1.4 or later can experience an issue where the installation cannot be completed due to a "WinCollect 10 Setup Wizard ended prematurely" error. This issue caused by a new virtual account feature added in WinCollect 10.1.4. To resolve this issue, you must install the WinCollect update from the command line on an elevated account.

Symptom

Administrators who attempt to install WinCollect 10 by double-clicking the MSI file receive the following error, "WinCollect 10 Setup Wizard ended prematurely" even when all fields are completed correctly.

Error message
image-20230508152348-1
Figure 1: Error message displayed when attempting to double-click the MSI file to update your WinCollect agent.

Cause

The changes in WinCollect 10.1.4 allow for virtual accounts as a new feature. Due to the virtual account changes, administrators must install WinCollect from the command line to resolve this issue.
List of issues that can cause a setup ended prematurely error:
  1. The user double-clicked the MSI file to install WinCollect 10.1.4.
  2. The user right-clicks the MSI file and selects Install in Windows Explorer.
  3. You previously installed WinCollect 10.1.4 and attempted to use the Windows repair function to reinstall the MSI.

Resolving The Problem

To resolve this issue, administrators can complete the installation from the command line.

Procedure
  1. Log in to the Windows host.
  2. Open the command line as an administrator.
  3. To install the WinCollect agent, type: 
    msiexec.exe /qn /i WinCollect-10.1.4-44.x64.msi QUICK_INSTALL="yes" WC_DEST="IP_ADDRESS_OR_FQDN" ADMIN_GROUP="true"
    For example, you can use the hostname of your QRadar appliance or the IP address of any Event Collector, Event Processor, Data Gateway, or Console. 
    msiexec.exe /qn /i WinCollect-10.1.4-44.x64.msi QUICK_INSTALL="yes" WC_DEST="qrhostname.domain.lab" ADMIN_GROUP="true"
    msiexec.exe /qn /i WinCollect-10.1.4-44.x64.msi QUICK_INSTALL="yes" WC_DEST="x.x.x.x" ADMIN_GROUP="true"
    Note: The destination is created automatically on the local WinCollect agent. Virtual accounts are supported on Windows 7 operating systems and above. For more information, see WinCollect virtual accounts feature.
  4. Wait for the command prompt to return.

    Results
    The WinCollect 10.1.4 agent installs successfully. To verify the installation, press the Windows key and select IBM WinCollect 10 Console to launch the agent user interface. It is expected that the application starts and displays events forwarded to QRadar. To verify the receipt of the events, users can search the Log Activity tab for the Source IP of the Windows host.
    image-20230508154739-3
    Figure 2: Run the IBM WinCollect 10 Console to verify the application starts as expected.

    image-20230508155044-4
    Figure 3: The WinCollect application displays events forward to the QRadar destination.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSKMKU","label":"IBM QRadar on Cloud"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
11 May 2023

UID

ibm16988983

Page Feedback