M1 Apple Silicon pkg installation failed

[janzaldua]

I've read through a few posts already, stating to compress the pkg as a zip first, then upload to JAMF, but I'm having the same issue. When I try to install the package directly on the machine, it works fine. But if I install it from JAMF via a policy, it errors:

The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.

Not sure what else to try at this point. It happens on both Monterey & Ventura.

[AntMac]

Hi 
Reading between the lines I am guessing this is possibly Creative Cloud you are trying to upload? 
Can you please advise/confirm which application you are trying to upload?  

[janzaldua]

CyberArk EPM client

[AntMac]

Ah sorry, not very familiar with this product. If it was Creative Cloud could offer some suggestions.
Would suggest if you can to have a look at the installer logs to try and get more information on where the install failure is occurring. The error message provided is a pretty generic one. Install log generally yields more information on where things are failing.    

Not sure why you would need to zip up CyberArk seems a little odd, would understand if it needed to be packaged/captured with Composer. Quick reads I have done mainly talk about having to extract the pkg from a zip file for upload. It does appear that the vendor does have a JAMF installer script and documentation under their KB 000009592. I'm not a registered user so can't see the documentation and script. But I suspect you've already looked at that. 

Also there is this previous JAMF Nation post from 2020 with comments from 2021 indicating working install solutions. Re: CyberArk EPM Deployment - Jamf Nation Community - 231644

Maybe they would be of some help or someone else who is familiar with the software will chime in?  

[spesh]

My company uses the web portal of CyberArk, so this may not be relevant or helpful.

Since the installation process involves system extensions and/or full disk access,  creating configuration profiles in conjunction with the package might be a good idea. This wouldn't necessarily explain why you are able to install the package directly on machines might be worth looking into.

This article from CyberArk may be of some assistance: https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM/Latest/en/Content/Installation/macOS-InstallAge.... 

Additionally, the answer may lie in their system requirements article, which you can find here: https://docs.cyberark.com/Product-Doc/OnlineHelp/EPM/Latest/en/Content/Installation/macOS-SystemRequ.... 

Hope this helps!

[YanW]

It's not what the "official way" but work for us on Monterey to Ventura with Intel or M1. I put the .pkg with the .config together in Shared folder. Create a .pkg with Composer and upload it to Jamf. I've tried different locations but failed. In the end, we decided using Shared. We use another product for password rotation, so we don't use the -u & -p. 

In Files and Processes

/Users/Shared/CyberArk_22.4.0.130/Install\ CyberArk\ EPM.app/Contents/MacOS/CyberArkEPMInstaller -k Put Your Installation Key Here -c /Users/Shared/CyberArk_22.4.0.130/CyberArkEPMAgentSetupMacos.config;  sleep 20;  rm -rf /Users/Shared/CyberArk_22.4.0.130/

 use PPPC-Utility allow access SystemPolicyAllFiles

com.cyberark.CyberArkEPMEndpointSecurityExtension

com.cyberark.CyberArkEPM

As for System Extensions

com.cyberark.CyberArkEPMEndpointSecurityExtension

*If anyone has better and cleaner way to do it, please let me know. Thanks

[janzaldua]

Thanks for the replies everyone. I have seen most of the articles and forum posts already, but no luck yet. @YanW - I may have to try it that way, but I'm not exactly sure what you mean by 'Create a .pkg with Composer' ? Do you just mean via Terminal

[YanW]

The zip file provided by CyberArk contains the .app and the .config which you need to run. I created a folder in Shared with both .app and .config > opened Composer > Dragged the folder in it > Created .pkg > Uploaded to Jamf > The policy contains the pkg and with the command above in Files and Processes. We only use the most basic flags to install, you can add others based on what you want

[janzaldua]

Unfortunately, our company requires the -u & -p commands to be present. But when I try to run it, it fails and gives this error...

[janzaldua]

I may have figured this out... I thought the 'secure token' it was referring to was a secure token provided by CyberArk. But it is referring to FileVault 2 enabled users... In order for the install to complete, FileVault 2 needs to be enabled for that specific user that is being targeted for the install.

After I enabled Filevault 2 for the local user account, the install works perfect. Although I still do get a popup asking to allow Terminal to administer the computer. I'm not sure how to get rid of that.