CiscoVPN Client / 32-Bit Vista / Error 1720

I just spent 4 hours trying to figure out why the latest version of CiscoVPN Client wouldn’t install, and kept giving me this:

Error 1720: There is a problem with this Windows Installer package. A script required for this install to compelete could not be run. Contact your support personnel or package vendor.

When I tried to google the error (and an unreal number of permutations of it), the results came up with all kinds of suggestions (specifically, re-download the file, clean your registry, clean your partial installs, and re-install windows installer package.) Unfortunately for me, none of those worked – the problem wasn’t a corrupted file, a glitch in the registry or an outdated installer package.

I uninstalled my anti-virus and even disabled UAC, it didn’t make a difference. I downloaded 4 different versions of the VPN Client, all of which failed at the exact same point with the exact same un-informative “Error 1720″ error message.

After some digging I was able to see that the .exe I downloaded actually just extracted an .msi and some other files (12 in total). Realizing I could run msiexec in verbose mode and dump it to a log file:

C:\Users\{username}\AppData\Local\Temp>msiexec /i vpnclient-setup.msi /l*vx vpn.log

… I did just that.

I got a whole bunch of spew and somewhere buried was this error:

MSI (s) (80:84) [21:53:31:545]: Doing action: CsCa_GetLocalPrivName
Action 21:53:31: CsCa_GetLocalPrivName.
Action start 21:53:31: CsCa_GetLocalPrivName.
MSI (s) (80:84) [21:53:31:549]: Creating MSIHANDLE (894) of type 790542 for thread 7556
MSI (s) (80:F4) [21:53:31:549]: Creating MSIHANDLE (895) of type 0 for thread 7412
DEBUG: Error 2835:  The control ErrorIcon was not found on dialog ErrorDialog
Internal Error 2835. ErrorIcon, ErrorDialog
Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action CsCa_GetLocalPrivName script error -2146827858, Microsoft VBScript runtime error: Class doesn't support Automation Line 9, Column 1,
MSI (s) (80:F4) [21:53:33:888]: Product: Cisco Systems VPN Client 5.0.05.0290 -- Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action CsCa_GetLocalPrivName script error -2146827858, Microsoft VBScript runtime error: Class doesn't support Automation Line 9, Column 1,

To be honest, I really have no idea what that means, even now after fixing the installer. I spent some time on google looking for the missing control ErrorIcon – that turned out to be a red herring and not really even a problem.

I then spent time looking up this: CsCa_GetLocalPrivName

This looked a little more promising and I found this link.

It said:

Had some problems with 5.0.02.6060 when logged in to a domain, using localized (Swedish) Windows so I’m not sure if the problem exists on other configurations.

The installation took about 35 minutes to complete if the computer where attached to the network when installing, when logged in locally it took 4 minutes.

Solved it by make an MST and remove custom action CsCa_GetLocalPrivName and then set these properties with custom actions:
GROUP_INTERACTIVE
GROUP_USERS
GROUP_LOCAL_SYSTEM
GROUP_ADMINISTRATORS

Now I consider myself a pretty proficient power user, but this just baffled me. WTF is an MST, what are custom actions, and what are these groups all about?

After some more googling, I found Orca, available here. Orca is an amazing utility that allows you to edit many of the parameters contained within a .msi installer file.

So going headfirst, I backed up the vpnclient_setup.msi and started up Orca and opened the msi.

Orca now opened a whole slew of tables, each of which I could click on and edit the data inside — pretty cool!

The first thing I did was go under the CustomAction table and find the CsCa_GetLocalPrivName Action. Sure enough it was there. Simply right clicking on the row and selecting “Drop Row” took care of that – deleted.

Could it be that easy? I saved, closed it in Orca (otherwise it will not allow you to run the .msi) and attempted to run the .msi file.

It got past the sticking point that it had always failed at, proceeded to do a few more things and failed again — this time with Error 1721.

Before I went and did the whole diagnostic thing (with verbose logging), I tried to do the rest of the steps in the linked post, remember? The stuff about adding properties with CustomActions…

Well I have no idea about CustomActions, so I tried searching for how to set properties with CustomActions and couldn’t figure it out quick enough. From the random snippets of pages I read about CustomActions in Orca, I ended up getting enough confidence to just add the properties in the Property table and hope for the best.

I added the keys (Properties) but didn’t know what to put for the value… hmm.

I searched for one of the Properties I added: GROUP_USERS. It came up with the key I just added (obviously), but one press of F3 came up with an entry in the LockPermissions table:

LockObject Table Domain User Permission
INSTALLDIR CreateFolder [GROUP_USERS] -1610612736

Farther down in the table was a row with LockObject=registry7 that had User=Everyone.

That’s interesting. It looks like the [GROUP_USERS] is just some sort of variable. I took a guess that a reference to [FOO] would really just evaluate to the corresponding value of the FOO key in the Property table — it seemed logical.

Before I left the LockPermissions table, I noted that that acceptable permissions were “Everyone” and “Administrators”.

I thought, I’ll just go into Users and Group Management, find out the group names, and replace them as values to the appropriate keys in the Property table. Almost! The box I was working on was running Vista Home Premium Edition, and I couldn’t add the User and Group Management snap-on to mmc, of course not, why would it be that easy?

I said screw it, and just picked values I knew were acceptable “Everyone” and “Administrators”.

I assigned the value “Everyone” to GROUP_INTERACTIVE, GROUP_USERS, and GROUP_LOCAL_SYSTEM and assigned the value “Administrators” to GROUP_ADMINISTRATORS — seems good to me?

After that, I was feeling pretty good, saved the .msi file, closed it from Orca and ran it again — voila! It got past the first sticking point (Error 1720), the most recent error (Error 1721) and continued installation all the way to successful completion — It worked!

After a quick reboot I was up and running the VPN Client I have spent hours trying to get working.

I’ll recap the fix for those in a hurry, but before I do that, I’m going to list some of the versions of software that I was using:

  • VPN Client Version: vpnclient-win-msi-5.0.05.0290-k9.exe
  • Windows Vista: Windows Vista Home Premium SP1
  • Orca: Version 3.1.4000.2049

Presented below are the quick steps to fix the problem:

NOTE: I include some steps here that are, in actuality, optional, but its good practice to make sure you’re having the same problem (or at least the same error message) I was, otherwise you could be spending a lot of time tweaking the .msi for no reason.

  1. Run the unpackager (vpnclient-win-msi-5.0.05.0290-k9.exe).

  2. Make note of the “Unzip to folder” location (copying it to the clipboard is useful), uncheck the “When done unzipping open” box and click “Unzip”

  3. Open a console window (might want to run as Administrator just to be safe) – Start, Run, “cmd”, Hold Ctrl+Shift and Press Enter

  4. Navigate to the “Unizp to folder” location. Mine was C:\Users\{username}\AppData\Local\Temp\

  5. Run msiexec in verbose logging mode: msiexec /i vpnclient-setup.msi /l*vx vpn.log

  6. Follow through with the installer that pops up as you would any other time.

  7. Allow it to fail at Error 1720, roll back and exit.

  8. Open up notepad and navigate to the same “Unzip to Folder” – you can paste the path in the filename box or you can navigate there manually (you may have to manually type AppData into the filename box and press enter when you get there, as it is hidden by default. Remember, there is no space between AppData and the A and D are capitalized. If you did it correctly, no error will pop up and you should see the Local folder to continue navigating.

  9. Open the vpn.log file.

  10. Search for “1720″ and verify that you see the same error as I listed above.

  11. If you don’t, you can certainly continue, but this may not work at all.

  12. Close the notepad.

  13. Download, install and run Orca.

  14. Navigate to the path (or paste the location in the filename box) and open the .msi file (mine was called vpnclient-setup.msi).

  15. Backup the msi by clicking File->Save As and renaming a copy as vpnclient-setup-backup.msi.

  16. Close the backup, and open the vpnclient-setup.msi

  17. In the left panel select CustomAction

  18. In the newly populated right panel find the Action titled CsCa_GetLocalPrivName, right click on it and select Drop Row. Confirm by clicking OK.

  19. In the left panel select Property

  20. Ensure the right panel has column headers “Property” and “Value”

  21. Right click in the right panel, and select Add Row.

  22. In the Add Row Dialog, select Property (under Name), ensure it says Property above the text box and type “GROUP_INTERACTIVE” without quotes (and without brackets).

  23. Now select Value (under Name), ensure it says Value above the text box and type “Everyone” without quotes.

  24. Confirm by clicking OK

  25. Complete steps 21-24 for the last three entries (assigning the value “Everyone” to GROUP_INTERACTIVE, GROUP_USERS, and GROUP_LOCAL_SYSTEM and assigning the value “Administrators” to GROUP_ADMINISTRATORS)

  26. Save the tweaked .msi by clicking File-Save.

  27. Close the tweaked .msi by clicking File-Close.

  28. In the command window / terminal, try the install again (verbose logging is optional). Alternatively, run the installer from an Explorer window by navigating to the folder and double clicking on it.

  29. If you did everything correctly, and had the same problem as me, you should be off to the races!

Good Luck!

Posted Tuesday, September 15th, 2009 under windows.

Tags: ,

116 comments

  1. Thank you! Thank you! Thank you! :)
    I was so frustrated, googling and reading and trying everything to no avail, until I found your article. It totally worked!!!

  2. Sounds like a lot of work! Good Stuff.

  3. amazing, worked perfectly!!!

  4. Excellent, Excellent !!! You saved me a lot of time and effort. Thumbs up !

    THANKS

  5. A thousand blessings on your head!!!!! Fantastic sleuthing, and detailed steps. Worked like a charm. Finally, I can go to bed! THANK YOU!

  6. You win the internet!

    I would give you a hug, but I imagine you will find my resisting such form of gratitude an even greater reward.

  7. “Complete steps 21-24 for the last three entries”

    Which last three? I don’t get it. Thx

  8. Hi Fosi,

    Repeat steps 21-24 and instead of setting the value of GROUP_INTERACTIVE to “Everyone”:
    Set the value of GROUP_USERS to “Everyone”
    Set the value of GROUP_LOCAL_SYSTEM to “Everyone”
    Set the value of GROUP_ADMINISTRATORS to “Administrators”

    Regards,
    Jim

  9. Worked! But still a little confusing! Perfekt! Thx

  10. Great! Sorry for the confusion.

    Regards,
    Jim

  11. Bo Andersen says:

    Luv u man

  12. Sammy Van den Broeke says:

    Damn nice work man that must indeed have costed u alot of work congratz and thanks alot ! Saved me some headache ^^

  13. Mihail Kalmykov says:

    Thank you!
    It works!

  14. You are GREAT !!! Please tell to CISCO to correct their MSI file :)

    REGARDS,
    Jovan.

  15. I must say that I am so happy I could scream. This is an amazing piece of work you have accomplished. Fantastic job! Worked for me and perfectly!

  16. It just works. I’ve spent hours trying to install it and my IT hadn’t a clue about was going wrong. Many thanks for this page!

  17. I’m the head of my IT department and I was baffled. This helped me out so much! Thanks a million for writing this up! It saved me hours!!!

  18. Now if you can only solve “442 failed to enable virtual adaptor” error, without using one of the continually repeated solutions all over the web with one of yours that works i’ll be eternally grateful :-)

  19. Thanks a lot for this contribution! It really helped me and saved a lot of time.
    Thanks again!

  20. I’d like to chime in on thanking you for the quality and effort it must have taken to get to this point. I’m an advanced MSI repackager and this issue \ error had even me baffled after looking at CISCO’s verbose error logs and their MSI source code.

    What still has me puzzled is the following. We use automation heavily for just about everything -> including VPN upgrades. With great power comes great responsibility -> and when a very small % of our deployments hit this snag (2% or less0 it was a concern. Still can’t wrap my head around why this is only required on a few -> all of whose root level folder permissions (e.g. the permissions toteh PFIles fodler and user profiles) seem identical to other machines where it installs fine. Given the locked down nature of our environmetn -> the failures are still a puzzle.

    No Q your solution and its explicit lock permissions table definitions for the install works -> just wondering why its needed in the first place.

  21. HELL, tried everything from reinstalling/updating all kinds of things, disabling UAC, cleaning/editing registries. Had almost given up until I stumbled upon your solution, this FINALLY did the trick for me.
    Beats the crap out of me how you found this stuff out but you are DEFINITLY the man! THUMBS UP!!

    greetz,

    B.

  22. Pete d'Angelo says:

    thanks so much, worked perfectly!!

  23. Great solution, this also works for Win2K3 x86 server on VMWare, I just had to make a simple DCOM setting change to netman….

    Thanks!

  24. Another eternally grateful soul here!
    Thank you!

  25. My gratitude for our help!!!

    * VPN Client Version: vpnclient-win-msi-5.0.07.0290-k9.exe
    * Windows XP SP3 (Localized)
    * Orca: Version 3.1.4000.2049

  26. Thank you so very much! Incredibly helpful!

  27. thanks man you are great

  28. Incredible. A life-saver – perhaps literally. Thanks!!

  29. This solution was incredible. I have no idea how you figured this out but you are amazing!!! – It worked perfectly for me the first time. Let’s hope that Cisco fixes this ASAP. Cheers!

  30. Thanks you so much for spending time in proving the descriptive steps. Very useful.

  31. Thank you! It helped me very much.

  32. Greaaaat!!! :-) ))

  33. great!! it works!!! hahaha… thanks man!

  34. Thank you so much it worked and saved me so much stress. Thank you so so much :-)

  35. Thanks a lot for this contribution! It really helped me and worked perfectly.

    Thanks again!!!

  36. Thank you so much for the article. Works great !

  37. Excellent documentation. Worked like a charm. Much appreciated.

  38. Thank you so much! My IT was scratching their heads. The best they could do was suggest upgrading my Windows. I’m running 64-bit Vista, and it worked beautifully. Your efforts, documentation and time are greatly appreciated!

  39. Thanks bro!!!. U saved my time.. Indeed a great tweak…

    Thanks one again!!!

  40. You are just wonderful. Worked like a charm.
    Thanks God for people like you.

  41. Thankful Dude says:

    Amazing!!!! It still works perfect… What the has wrong with these cisco guys???

    Cisco Systems VPN Client 5.0.07.0290

  42. Tht was indeed awesome. My support guy had asked me to format to resolve this issue. I myself had searched a lot for possible solution but nothing seemed to work. But ur post was just Superb. thanks a lot.

  43. You are the man <3

  44. Glyn Jones says:

    Incredible. 29 steps to victory!

  45. tinkureddy says:

    thank you sooooo much

  46. You are the best!! Thank you very much!!!

  47. Thanks, this really helped I was banging my head against the wall. We are prepping to move to Windows 7 and this program is a must so having a solution is great.

    Ran into this error on Windows 7 64-bit with Cisco VPN 5.0.07.0290.

  48. This problem blocking me for several week, and IS guy didn’t help to solve this. Thanks to your guide, it works perfectly…thank you so much…

  49. Thank you very much!!! Works fine with 5.0.07.0410 32bits

  50. Troy Thomas says:

    Grats, you are my Hero for the Day.

    Thanks.

  51. It’s worth noting that in order for me to get this to work I had to remove the “CsCa_GetLocalPrivName” property from “CustomAction” table. This is not called out in the numbered steps, but in the body of the post. If you’re like me (and were pulling your hair out) you might have missed it.

  52. pat the cat says:

    Thanks it done the trick

  53. Andreas Habel says:

    Thanks — it also worked with

    - XPSP2 64-bit
    - vpnclient-winx64-msi-5.0.07.0240-k9-BETA.exe

  54. David Lynch says:

    Thank you so much this worked so well. Man you have no idea how much time i spent working on this issue.

    thanks
    Thanks
    thanks
    Thanks

  55. Awesome post, i was going insane trying to figure this out.

  56. This worked on Windows 7 64-bits and cisco cliente 5.07 too!!!! Thanks, you’re my hero =D

    Greetings form Argentina

  57. Thanks, you are my hero ;-)

  58. Ignacio says:

    Many thanks!
    It worked perfectly!! (v5.0.07.0410)

  59. I was pushing an automated install to 120 machines with identical XPSP3 32bit images. 36 failed with Error 1720. Your post resolved the issue. We will use the modified .msi from here out.

    Thanks for the extremely useful help!

  60. This worked big time! Many thanks!!!

  61. Thanks from germany

  62. This also worked under Win 7 Pro 64-bit for v5.0.7.0440!

    Thanks for all your hard work!

  63. Thank you very much for taking the effort to write such a clear explanation, I would never have solved this on my own. (wndows xp/ v5.0.07.0290-k9)

  64. THANK YOU! Great steps; completely solved the 1720 issue on an x86 XP sp3 machine.

  65. man ……..YOU ROCK !!!!!!!!!

  66. Thanks a lot! It works fine with the same error on Win XP SP3.

  67. Thank you very much, there are many solutions provided in google, but this has resolved both 1720 and 1721 issues. SPOT ON.

  68. First of all – thank you. Worked well.

    In my case it was Error code 1720 with this text:
    Custom action CsCaVBS_CopyINIFiles script error -2146827859, Laufzeitfehler in Microsoft VBScript: ActiveX-Komponenten kann kein Objekt erstellen: ‘Scripting.FileSystemObject’ Line 7, Column 1

    Your instructions worked well.

  69. Jason Hartley says:

    Mate – you are a f-ing legend, this was busting my balls big time! Awesome!!!!!

  70. Unreal… this saved me several hours of gouging my eyes out. Thanks a TON!

  71. I had a client with XP sp3 and kept getting 1720 error. I tried everything from reinstalling windows installer to reregistring wmi and so on. Nothing worked. Then i came across your article and with a grain of salt decided to give it a try knowing full well that it will not worked, but to my amazement, this worked beautifully. I wanted to thank you for sharing your results. This is amazing. Thanks from Chicago!

  72. It worked for me!!!!!
    never had to tweak an msi before either.
    got Orca, did the steps listed and then did the install.
    no more 1720!!!!
    THANK YOU !!!!!

  73. Gordon Freeman says:

    Man the time I spent on this thing! I consider myself quite the system issue solver but this one was out of my league. Thank you very much for solving this for us.

    FYI, I had this issue on a VM with the following configuration:
    Guest: Windows Server 2008 R2 SP1 w/ Hyper V (Cisco installed and working)
    Host: Windows Server 2003 R2 SP2 w/ ActiveDirectory installed.
    Guest and host are logged using domain accounts with different domains.
    And also, the guest and host (precisely the virtual network to which the host is connected) share the same physical network adapter, which is a virtual switch connected to the guest’s wireless adapter.

  74. Thank you very much for this… =)

  75. GRAZIE MILLE AMICO

  76. Thank you, i really need the VPN to work and this post saves me from reinstalling Windows (that might be a waste of time).

  77. yo this works mane

  78. Muchas gracias!
    Hartelijk dank!
    Vielen Dank!
    آپ کا بہت بہت شکریہ!!
    Thank you Very Much!!

  79. Simply superb post.. Thanks a lot..

  80. Richard says:

    Thank you so much. This post was a god send – this error was driving me nuts.

  81. Worked for me on Windows XP x86 SP3 Cisco client version 5.0.07.0290-k9.
    Thank You :-)

  82. Worked perfectly. Many thanks!

  83. That is simply awesome! Worked first time. You’re a star. Many thanks.

  84. lot of thanks for solution…….after long long time i am searching about error 1720 finally i can fix it…..:D

  85. WasStuckInMSIHell says:

    Worked Awesomely- encountered this several times b4 w/ nobody able to solve

  86. Vinod Bonagiri says:

    Dude,

    I say, this is one of the best articles I have come through till date. Awesome fix.

    Thanks to Ryan Eastabrook as well !!!!!!!!

    - Vinod Bonagiri

  87. It is not enough text space to write the amount of thanks I have for you.
    Thank you very much!!!

  88. Eres la mamada compadre.. you are the One!! jajaja

  89. Hats off to you (sir or madam)! I have been trying to solve this problem for almost a year. I used Shrew until a new client’s PCF file would not import properly.

    You are a life saver!

  90. Hei, know what. I ran into that problem, followed your advice (without understanding a word, just trusting) and whoppe, IT WORX!

    Thanks a lot

  91. Thank you very much. struggled with this issue for many days and finallly your fix worked.

  92. Thank you for posting these instructions! They worked!!!

  93. Thank you! worked for a windows 7 pro 64bit install with vpn_64bit straight from Lenovo. Installed this on a ton of machines and never had this problem before!

    Thank you!

  94. Thank you, it works also with version 5.0.07.0410.

  95. When I’m in trouble installing or repairing anything in my pc,I usually search on the web to get these solved. And that’s it. Usually.
    But the 1720 error was a big challenge to me, and I could solve it with your guide.

    Thank you very much! Muchísimas gracias! :3

    Greetings from Colombia!

  96. You’re a god damn genious. Thank you!!!

  97. Thank you!!!
    This fixed our Problem on Win7 x64 (Client 5.0.07.0440)

  98. I was trying to install the vpn on a vista 32bit machine and hit the same UI error, but a different underlying error. I ran the MSI in logging mode as described in this very informative post and found the following error:

    Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor. Custom action CsCaVBS_CopyINIFiles script error -2147024770, : Line 7, Column 1,

    Now this error is different than the one described in this post, but nevertheless I opened the MSI in Orca, and instead of removing “CsCa_GetLocalPrivName” from CustomActions as mentioned in the steps, I removed “CsCaVBS_CopyINIFiles” that was being complained about in my log file.. and BINGO! It worked!! I did follow all other steps as given in the post (like creating the Groups).

    Thank you so much for this post.. It saved me and my colleagues a great great deal of trouble!!

  99. This worked for Windows 7 32 bit vpn clien installer v5.0.07.0410-k9. Thanks!

  100. Xavier Hidalgo says:

    Thank you so much !!!!!

  101. Still needed, and working in 2013! Thanks.

  102. Worked for me, thanks a lot!!

  103. Thank you very much. It worked perfectly. I was trying to install a vpn client on Windows 8 64 bit. I had done it once before, same computer but a previous installation of Windows (same version though). Somehow, something broke when I reinstalled windows. It boggles the mind how something like that can happen :\

  104. 100 people thanking you and still more coming, me i.e.!

    Worked perfectly. And i was in a bit of a hurry. And very interesting to learn about orca for .msi’s. Thanks a lot for sharing and being so clear in the make…

    In fact in my version of Cisco Client i also saw a typo in LockPermissions-Table, Lock Object-Logs, User- [GROUP_SYSETM] (literally), i wonder if correcting it could aswell work for 1721? Didnt try, preferred to follow your instructions.

    Windows XP SP3
    Cisco VPN Client 5.0.02.0090

  105. Francesco says:

    It worked! Thanks a lot!

  106. Man, respect, It is this want I needed :) Thanks for very good article,

  107. David Briggs says:

    The error is because the WMI service is not running / not registered correctly.

    Running these four commands will usually fix the issue:

    Regsvr32 %SystemRoot%\System32\wbem\wmidcprv.dll
    cd /d %windir%\system32\wbem
    for %i in (*.dll) do RegSvr32 -s %i
    for %i in (*.exe) do %i /RegServer

    If that doesn’t work, take a look at this article:
    http://social.technet.microsoft.com/Forums/en-US/winservergen/thread/96ef98d1-0de1-4fa9-b322-bf150c82cd46

  108. Thank you so much!

  109. It works for Windows 8.1 too

    Thanks :)

  110. Thanks for the info. This didn’t fix the 1720 error for me on XP but it and the comments pointed me in the right direction. Mine was corrupt WMI. Rebult the repository, re-registered the WMI components and then was able to uninstall the old v5 Cisco client and get AnyConnect to install. Thanks for posting.

  111. Excellent, worked a treat, thanks.

  112. perfect! Thanks for your help!!

  113. Worked a treat! This post is still helping people five years later. You are a wizard of the highest order and a saint, as well. Thank you so much. Windows 7 x64 and Cisco client 5.0.07.0440 x64.

  114. captn14me says:

    After finally getting to the point of no return, i was able to follow the above get it to work.

    Thank you

  115. Thanks for the note BD!

Leave a Reply