Skip to main content

Liongard Agent Installation Fails with Error 1603 Due to Trusted Publisher Certificate Restrictions

Liongard Windows Agent installation may fail with MSI error 1603 during the final stage of installation. This is typically caused by a security policy preventing the agent from writing to the Local Machine Trusted Publisher certificate store.

Symptoms

  • Agent installation fails with:

    • Error 1603

    • Error 26352

  • Installer logs show:

    • Failed to install certificate

    • 0x80070005 (Access Denied)

  • Installation progresses normally until the final step

  • Agent may:

    • Successfully register with the Liongard platform

    • Still fail overall due to certificate installation failure

Root Cause

The Liongard Agent installer attempts to install a certificate into:

Cert:\LocalMachine\TrustedPublisher

If the system blocks writes to this store, the installer will fail.

This restriction is typically enforced by:

  • Group Policy (GPO)

  • Software Restriction Policies (SRP)

  • Windows Defender Application Control (WDAC)

  • AppLocker

  • Endpoint Detection & Response (EDR) tools

  • Security baselines (CIS, STIG, etc.)

How to Confirm the Issue

Step 1: Review Installer Logs

Look for:

  • AddMachineCertificate

  • 0x80070005 (Access Denied)

Step 2: Run Certificate Permission Test

Use the LGAgentCertTest PowerShell script to validate certificate store access.

Expected results:

DavidChapmans_LGAgentCertTest.txt

  • ✅ Success writing to:

    LocalMachine\My

  • ❌ Failure writing to:

    LocalMachine\TrustedPublisher

If TrustedPublisher import fails with Access Denied, this confirms a policy restriction.

Resolution

Option 1: Adjust Group Policy (Recommended)

Allow writes to the Trusted Publisher store:

Computer Configuration
→ Windows Settings
→ Security Settings
→ Public Key Policies

Review and modify:

  • Trusted Publisher settings

  • Certificate handling restrictions

  • Software Restriction Policies (if present)

Option 2: Review Security Controls

Temporarily disable or adjust:

  • EDR / AV tools (CrowdStrike, SentinelOne, etc.)

  • AppLocker / WDAC policies

Option 3: Validate Scope of Issue

Test installation on:

  • A non-domain machine

  • A machine in a less restrictive OU

If installation succeeds, this confirms the issue is policy-related.

Additional Considerations

  • The issue may affect only specific servers if:

    • Different OU policies are applied

    • Local security settings differ

    • Security tooling is scoped differently

  • This can also impact:

    • Existing agents not checking in

    • Other certificate-dependent operations

Outcome

Once the restriction is removed:

  • Agent installs successfully

  • Certificate is written to Trusted Publisher

  • Agent communicates normally with Liongard

Best Practice

If agent installation fails:

  1. Confirm network connectivity

  2. Review logs for certificate errors

  3. Validate certificate store permissions early

Related Errors

  • 0x80070005 (Access Denied)

  • MSI Error 1603

  • MSI Error 26352

Attachment icon
DavidChapmans_LGAgentCertTest.txt
Did this answer your question?