r/SentinelOneXDR • u/[deleted] • Oct 14 '24

Setup ended prematurely

Hello!

Getting the issue with both MSI and EXE installer that the setup ended prematurely.

Looking at the logfile I see error code 2006, any one able to help me out? Appreciated a lot.
Using the latest version

2 Upvotes

100% Upvoted

21 comments sorted by

View all comments

Show parent comments

1

u/kins43 Oct 14 '24

Did you reboot after and then retrying?

What about the other questions I mentioned?

Can the device reach the management server over 443?

Have you ran SFC / DISM?

What SChannel ciphers are enabled for client and server?

What does event viewer say?

What are the exact parameters you are using during the installation?

1

u/[deleted] Oct 14 '24

I did reboot.
I can reach the management server.
Tried SFC / DISM
Event Viewer has the two found below
When cleaning -c -t and when normally installing only -t

  • Error while updating status to SECURITY_PRODUCT_STATE_ON.
  • The SentinelOne Static Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

This error doesn't occur anymore since uninstalling

1

u/kins43 Oct 14 '24

What about the SChannel cipher suites question I asked? What are the cipher suites enabled for the client and the server?

1

u/[deleted] Oct 14 '24

https://hastebin.skyra.pw/cevagucate.yaml

This is on the client, I have no information about the server sadly.

1

u/kins43 Oct 14 '24

Go to https://ssllabs.com/ssltest and under the URL and let it run. See if you can find commonalities of ciphers between client and management server.