Jamf Infrastructure Manager installation keeps rolling back

[macinblack]

Does anyone have recommendations for installing Jamf Infrastructure Manager? I am receiving the attached rollback error after initiating the installation and entering the verified parameters. I used the following as resources:

https://hcsonline.com/support/white-papers/installing-jamf-infrastructure-manager-on-a-windows-server

https://docs.jamf.com/infrastructure-manager/2.1.0/Installing_a_Jamf_Infrastructure_Manager_Instance.html

The system settings are as follows:

Windows Server 2016 x64 VM (patched, latest build).
4 GB RAM
80 GB HD w/ plenty of disk space available
Java 11 w/ path configured

I currently have a ticket open with Jamf but so far the troubleshooting suggestions have been fairly basic steps that I had already taken like ensuring the FQDN is used for hostname and installing from an elevated command prompt session. The login credentials for the API user are also valid.

The installation log is extremely verbose but I parsed every single line. There is a single 1603 error reference indicating SYSTEM doesn't have file permission access but it does. The only other relevant information the log provides is to validate that the installation parameters were entered correctly.

[macinblack · Accepted solution]

@xian Thanks for your response. I forgot to mark this resolved. I submitted a ticket to Jamf and it made its way to a couple of engineers who were able to help us diagnose the issue. It turns out that Amazon Corretto 11 is not just the recommended flavor of Java for JIM 2.1 (we were using OpenJDK 11.0.7) but is, in fact, a requirement to get it working with Windows Server 2016. I can't speak for previous or newer versions of Windows Server, but that is the case with the current build of WS16.

[macinblack]

I also noticed this in the logs and realized I misinterpreted the 1603 error at first glance. It seems to be an issue with the API user account but I tested the account and verified it works and that the information is correct. I temporarily gave the account full permissions for testing too.

JIM (c) (12:01) [18:06:56:633]: Getting an enrollment invitation for the Infrastructure Manager from the JSS...
Exception thrown by custom action:
System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.ComponentModel.Win32Exception: The system cannot find the file specified at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at Jamf.InfrastructureManager.InstallUtilities.Utilities.LaunchExe.Start() at Jamf.InfrastructureManager.InstallUtilities.JssInvite.GetInvite() at Jamf.InfrastructureManager.InstallUtilities.CustomActions.GetJssInvitation(Session session) --- End of inner exception stack trace --- at System.RuntimeMethodHandle.InvokeMethod(Object target, Object arguments, Signature sig, Boolean constructor) at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object parameters, Object arguments) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object parameters, CultureInfo culture) at Microsoft.Deployment.WindowsInstaller.CustomActionProxy.InvokeCustomAction(Int32 sessionHandle, String entryPoint, IntPtr remotingDelegatePtr)
CustomAction JIM_InstallUtilities_CA_GetJssInvitation returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
Action ended 18:06:56: InstallExecute. Return value 3.

[xian]

I was able to install it on a Windows 2012 R2 server while logged in as the local administrator. It's been awhile, but I believe that I initially had similar issues when trying to install while logged in with a different account that had domain privileges but wasn't the local admin account on the server.
That being said, our network team eventually determined that a public EIP would never work without the server being in a public subnet.

[macinblack · Accepted solution]

@xian Thanks for your response. I forgot to mark this resolved. I submitted a ticket to Jamf and it made its way to a couple of engineers who were able to help us diagnose the issue. It turns out that Amazon Corretto 11 is not just the recommended flavor of Java for JIM 2.1 (we were using OpenJDK 11.0.7) but is, in fact, a requirement to get it working with Windows Server 2016. I can't speak for previous or newer versions of Windows Server, but that is the case with the current build of WS16.

[ctarbox · Accepted solution]

Thanks for posting the solution. I was attempting to install JIM 2.20 with OpenJDK and receiving the same failed installation and rollback. Installing Amazon Corretto 11 was the fix for me. 

[ravisgupta]

@bhardawa that did not work for me

[macinblack]

@ravisgupta Are you seeing the same error? Also, what platform are you installing on? I should also mention that I saw results when I used a local admin account, rather than a domain admin account to complete the setup on one machine. The other machine (we have a public and private domain) did not have issues with the domain admin. I haven't figured out why that is, however.

[ravisgupta]

@bhardawa I relaunched it the other day via CLI as admin and that worked ...

[SZPAG_Jamf]

@bhardawa can you help me to solve this issue?

[macinblack]

@SZPAG_Jamf Your mention did actually link to my account so I missed this. Are you still experiencing an issue? I'm more than happy to help you troubleshoot.

[sukhan]

@bhardawa, I am trying to deploy JIM 2.1.0 on server 2012 R2 with java 11 and used local admin account to install the same but getting same error. Also using the split DNS method ( external facing Host and internal facing host). Appreciating you, if there could be a help on this.

[macinblack]

@sukhan 2012 R2 is compatible per the user guide. Are you using Amazon Corretto Java 11? It's pretty deep in the documentation but that is the required version, it seems.

I believe this is the correct link: https://docs.aws.amazon.com/corretto/latest/corretto-11-ug/downloads-list.html

Let me know how that works out.

[kevin_v]

This has started happening to our org. The Corretto install didn't help so far. MSI still fails.

[neilpotter]

Got mine working through one of the following (tried too much in one go, sorry)

1) Ensure the Amazon Correto version of JDK 11 is used and NOT the Oracle version. Obv uninstall oracle if installed.
2) Add the Paths for java into Computer Properties / Advanced Settings / Environment Variables.
JAVA_HOME was already there, pointing to c:Program FilesAmazon Corretojdk11.0.10_9
I added JRE_HOME to the same path
Also added JIM_HOME to point to c:program filesJamfInfrastructure Manager
3) Added my domain admin user to the Local "Administrators" group.

Once done, all installed ok. Judging by the error, I'm tempted to say it was point 2, however I did try 1&2 with a failure, then did 3 and rebooted, then it installed.

[ericstrom]

@neilpotter, 2 was the difference maker for us.

[danny_b]

Just wanted to add that I ran into the same problem with the "JRE_HOME" environment variable and the needed server reboot after installing Amazon Corretto and setting JRE_HOME. Got it working in the end.

As a result I opened a support case with suggestions to improve the JIM installation guide in the knowledge base, so others might have an easier time installing.

For reference I also want to add this link which describes the "Migrating to Java 11" process for JIM Servers that has the information about the JRE_HOME environment variable: https://docs.jamf.com/technical-articles/Migrating_to_Java_11_JIM.html (basically the reference to what @neilpotter posted)

Cheers!

[CodeNameTwinkie]

If you have issues running the MSI and it asks for a local account, then run CMD in admin mode and run the MSI from there.  I ran into the same thing and I just renamed the MSI something easy and ran it from the download location in DOS.

[Sonic84]

Just bumped this issue yesterday when upgrading JIM on a dev Win2k12r2 system. Turns out I accidentally grabbed a x86 update of Coretto by mistake. Installing the x64 version and updating the Env paths in Windows fixed the "Service 'jamf infrastructure manager' failed to start. Verify you that you have sufficient privileges to start the system service" error for me. 

[MihaiC]

Hello Team. We have to rebuild the Jamf Jim server due to a datacenter move. However we have stricter security controls.  Our issue is related to installing JIM application as the "invitation" is not received. We think that the invitation is coming from one of the Jamf servers (which have been put in the Firewalls) but we do not know the port used for that. We know that 8636 is the port when the application installed and working. Anyone having any idea? Thank you!

[macinblack]

@MihaiC

These two documents will answer all of your questions about networking, whitelisting, and port assignments for Jamf Pro:

• Network Ports Used by Jamf Pro 
• Permitting Inbound/Outbound Traffic with Jamf Cloud
  
  

[MihaiC]

Thank you for your answer. It turned out that this is due to our new datacenter setup that is more complex than initially considered. We are on the right track now. Best of luck!