Hi all,

I am currently trying to deploy an update for the Cisco AnyConnect VPN Client, that works for some computers.

On certain computers however, the client gets uninstalled and then fails to install (which results in upset users because they realize they can't start the VPN client any more, preferably in situations where they desperately need it...)

More technical details:

- The deployment runs as a required install in the system context.

- This is the command I'm using to install the application: msiexec /i "anyconnect-win-3.1.06073-pre-deploy-k9.msi" /norestart /passive /L*V "C:\msi.log" TRANSFORMS=COMPANY.mst

- I'm not manually uninstalling the VPN client first, I let MSI handle the upgrade install.

- The .mst file only creates a desktop shortcut and the .msi file is not modified in any way.

- With a global condition I'm checking if the VPN network adapter is currently active to avoid problems with an active VPN session while upgrading (services need to be restarted obviously, the connection would otherwise be cut off).

- As you can see from the parameters, I enabled MSI logging. I uploaded the logfile on pastebin, please tell me if that's against the guidelines / if I'm supposed to upload it somewhere else because I'm fairly new to the Technet forums. I'm also not verified yet, hence the malformed link.

pastebin .com/vjh3CQxB

I would appreciate it very much if someone can point me in the right direction here, this is really frustrating. Thanks!

Here is your error: Error 1303. The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help. The installation cannot continue. Log on as administrator or contact your system administrator.

Keep in mind that this is not really an ConfigMgr issue, but more an issue with the MSI. That means you might get better information with the supplier. As the MSI handles both the install as the uninstall I wouldn't be surprised that there is still an process of the uninstall holding files. I always like to keep those two separated.

Hi Peter, I suspected these lines as well.

The thing I don't understand is why the SYSTEM account can't access the directory because according to the NTFS permissions it has full access to C:\ProgramData and subfolders.

MSI (s) (A8:14) [08:25:33:331]: Note: 1: 1303 2: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help MSI (s) (A8:14) [08:25:33:331]: Product: Cisco AnyConnect Secure Mobility Client -- Error 1303. 

The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help. The installation cannot continue. Log on as administrator or contact your system administrator. Error 1303. The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help. The installation cannot continue. Log on as administrator or contact your system administrator.

• Edited by 0x00000c 16 hours 2 minutes ago

Maybe it's because the folder is already in use by another process? 

I have found it a lot less problematic overall to remove applications and then install the newer version rather than letting the Vendor MSI do an upgrade.

Some will work fine but sometimes you will run into issues.

If you remove the application with Msiexec /x GUID /qn does it come off and then allow you to install the new version?

If so you could just add the Msiexec /x command to the start of the wrapper script.

• Edited by -Richk- 13 hours 44 minutes ago

Hi Peter, I suspected these lines as well.

The thing I don't understand is why the SYSTEM account can't access the directory because according to the NTFS permissions it has full access to C:\ProgramData and subfolders.

MSI (s) (A8:14) [08:25:33:331]: Note: 1: 1303 2: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help MSI (s) (A8:14) [08:25:33:331]: Product: Cisco AnyConnect Secure Mobility Client -- Error 1303. 

The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help. The installation cannot continue. Log on as administrator or contact your system administrator. Error 1303. The installer has insufficient privileges to access this directory: C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Help. The installation cannot continue. Log on as administrator or contact your system administrator.

• Edited by 0x00000c Monday, February 23, 2015 8:13 PM

I have found it a lot less problematic overall to remove applications and then install the newer version rather than letting the Vendor MSI do an upgrade.

Some will work fine but sometimes you will run into issues.

If you remove the application with Msiexec /x GUID /qn does it come off and then allow you to install the new version?

If so you could just add the Msiexec /x command to the start of the wrapper script.

• Edited by -Richk- Monday, February 23, 2015 10:31 PM
• Marked as answer by 0x00000c 21 hours 8 minutes ago

Thanks for the answers. I will try something new later this week and will uninstall the old version first before installing the new version. I will let you know how that works out!

• Marked as answer by Joyce LMicrosoft contingent staff, Moderator 21 hours 30 minutes ago
• Unmarked as answer by 0x00000c 21 hours 9 minutes ago

Update: It works! Uninstalling the application before installing the new version is working without any issues. :)

• Marked as answer by 0x00000c 21 hours 9 minutes ago
• Unmarked as answer by 0x00000c 21 hours 8 minutes ago